Syslog-ng connector getting overloaded on conapp C5400
We've been experiencing problems with some of our heavily trafficked DNS servers that are pushing syslog-ng logs to a relatively low utilized C5400 Conapp. The smartconnector is in it's own dedicated container and the java heap has been maximized to 1Gb, but my DNS engineer is saying he is noticing a backlog on his end. He's mentioned that he will see 8-10 Syn request packets being sent from his servers, but my conapp is only acknowledging about 2-3 of those, thus the backup in his logs. I don't see my network bandwidth being overloaded. I've even tried changing this to a standard syslog daemon connector since we didn't seem to have problems with that before, but we are still having the same problems.
Are there any other configuration settings I should check?
Re: Syslog-ng connector getting overloaded on conapp C5400
I really recommend taking a look at this presentation from a previous Protect conference:
It goes through the bottlenecks and where to look and what you can do to correct this. Memory is a great place to start and improve things, but its not the only thing and there are a bunch of other things to look at too. I really recommend going through the presentation carefully too. Usually some small changes can make some significant gains.