5.2.2. Limiting the rate of messages

The syslog-ng Agent can control the rate of messages (message per second) sent to the central server. That way sudden message-bursts can be avoided, and the load of the server is decreased.

To limit the number of messages sent to a destination, complete the following steps:

Procedure 5.2.2.1. Limiting the number of messages

  1. Start the configuration interface of the syslog-ng Agent for Windows application.

  2. Select syslog-ng Agent Settings > Destinations > Network, and double-click on IPv4.

  3. Select the destination server and select Edit. To limit the number of messages that the syslog-ng agent sends to the server per second, enter the desired limit into the Throttle field. By default (0), the syslog-ng agent does not limit the number of messages sent.

    [Note] Note

    The throttling parameter applies to the total number of messages sent, not to every source independently. The same value applies to the failover servers of the destination.

    If you are sending messages to multiple servers, then the speed of the primary server is important: if the primary server cannot accept the messages fast enough, the syslog-ng agent will reduce the number of sent messages to match the speed of the primary server, even if the secondary servers could accept messages faster. If the secondary servers cannot accept messages as fast as the primary server, then the secondary servers will lose messages; the syslog-ng agent will not slow down to wait for them.

  4. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service.


© 2007-2010 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com