The syslog-ng Agent can control the rate of messages (message per second) sent to the central server. That way sudden message-bursts can be avoided, and the load of the server is decreased.
To limit the number of messages sent to a destination, complete the following steps:
Procedure 5.2.2.1. Limiting the number of messages
Start the configuration interface of the syslog-ng Agent for Windows application.
Select , and double-click on .
Select the destination server and select . To
limit the number of messages that the syslog-ng agent sends to the server
per second, enter the desired limit into the Throttle
field. By default (0), the syslog-ng agent does not
limit the number of messages sent.
![]() |
Note |
|---|---|
|
The throttling parameter applies to the total number of messages sent, not to every source independently. The same value applies to the failover servers of the destination. If you are sending messages to multiple servers, then the speed of the primary server is important: if the primary server cannot accept the messages fast enough, the syslog-ng agent will reduce the number of sent messages to match the speed of the primary server, even if the secondary servers could accept messages faster. If the secondary servers cannot accept messages as fast as the primary server, then the secondary servers will lose messages; the syslog-ng agent will not slow down to wait for them. |
Select , then . To activate the changes, restart the syslog-ng Agent service.
© 2007-2010 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com