1

I'm working on optimizing and right-sizing my EC2 syslog-ng servers and have some carryover settings in our ansible playbook for kernel settings that were used on "in-house" data center machines. (Previosly we also used syslog-ng in the DC, whereas now we are using SC4S)

Related to net.core.netdev_max_backlog specifically:

Redhat portal states the default is 1000, but we're currently setting it to 65536, and I don't have any records of why or where that recommendation came from.

I've found lots of helpful articles here and on the Redhat portal about testing and increasing this setting, but what is the impact of this being set too high?

kernel parameter - net.core.netdev_max_backlog , what happened when its too low

https://access.redhat.com/solutions/1241943

4
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Nov 10, 2022 at 13:58
  • It relates to the maximum amount of backlog. This a higher value creates a larger log, and a larger log will cause a slight slowdown for creating the log and a larger filesize.
    – LPChip
    Nov 10, 2022 at 14:41
  • this may be helpful - stackoverflow.com/a/3923785/4418
    – warren
    Mar 6, 2023 at 13:57
  • see also kernel.org/doc/html/latest/networking/scaling.html " Flow limit is useful on systems with many concurrent connections, where a single connection taking up 50% of a CPU indicates a problem. In such environments, enable the feature on all CPUs that handle network rx interrupts (as set in /proc/irq/N/smp_affinity). The feature depends on the input packet queue length to exceed the flow limit threshold (50%) + the flow history length (256). Setting net.core.netdev_max_backlog to either 1000 or 10000 performed well in experiments. "
    – warren
    Mar 6, 2023 at 13:58

0

You must log in to answer this question.

Browse other questions tagged .