https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-Suggestions-for-TCP-Syslog-Running-on-Server/m-p/168396#M34078 <P>Resolved issue with our RHEL UDP syslog environment. WinOS was not able to increase receive buffers to amount that was required.</P> Tue, 21 Oct 2014 15:34:51 GMT jodros 2014-10-21T15:34:51Z https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-Suggestions-for-TCP-Syslog-Running-on-Server/m-p/168395#M34077 <P>I know this is not a Splunk specific question, however I have asked a similar question in the past about tuning for UDP syslog on linux. I need to know what to watch out for when dealing with high volumes and bursts of TCP syslog. This is a Server 2012 VM using vmxnet3 drivers. I have maxed out the Small/Large RX Buffers as well as RX Ring #1/#2 Size. I have also tested enabling/disabling LSO V2 (IPv4) but that had little impact.</P> <P>Any assistance would be appreciated.</P> <P>Thanks</P> Wed, 15 Oct 2014 21:14:00 GMT https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-Suggestions-for-TCP-Syslog-Running-on-Server/m-p/168395#M34077 jodros 2014-10-15T21:14:00Z https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-Suggestions-for-TCP-Syslog-Running-on-Server/m-p/168396#M34078 <P>Resolved issue with our RHEL UDP syslog environment. WinOS was not able to increase receive buffers to amount that was required.</P> Tue, 21 Oct 2014 15:34:51 GMT https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-Suggestions-for-TCP-Syslog-Running-on-Server/m-p/168396#M34078 jodros 2014-10-21T15:34:51Z