Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Kiwi Syslog Server > Inbound message limit to stop packet loss

Inbound message limit to stop packet loss

Table of contents
Created by Norsolihati Selamat, last modified by Rodim Suarez on Aug 31, 2016

Views: 24 Votes: 0 Revisions: 3

Overview

This article describes the inbound message limit to stop packet loss.

Environment

All Kiwi Syslog versions

Detail

The inbound message limit to stop packet loss is a message buffer. As messages are received via the inputs (UDP, TCP, SNMP, Keep Alive), the messages are placed in an internal queue. The messages are then taken from the queue and processed in the order they arrived (FIFO). If a burst of messages arrive while the processing engine is busy, the messages are queued. This ensures messages are not lost under times of heavy load. 

Each message that is queued uses a small amount of memory. In most situations, buffering up to 20,000 messages is sufficient. You may want to increase the buffer size in situations where messages are arriving in large bursts. The buffering will smooth the message flow and allow the processing engine to catch up when it can. 

Messages are stored in Unicode which uses 2 bytes for each character. Therefore, if each message is 100 characters, it will occupy 200 bytes of memory. Messages can vary in size based on their content. 20,000 messages of 100 characters each will use 4,000,000 bytes (4MB) of memory. If each message was 200 characters long, it would use 8MB of memory. Memory is only used when the messages are being queued. Under normal traffic loads, the processing engine will be able to keep up with message flow and no messages will need to be queued. 
 
 

 

 

 

Last modified

Tags

Classifications

Public