Getting Data In

Is there a way to increase the maxQueueSize for Syslog output?

ludoz13
Path Finder

Hello Splunkers,

I would like to know if there is any way to increase the queue of my syslog group. I mean, currently I forward logs that are received on my Splunk through a tierce solution on syslog and the default queue is 97 KB. Please find below an example :

INFO Metrics - group=queue, name=my_syslog_group, max_size_kb=97, current_size_kb=0, current_size_kb=0, largest_size=0, smallest_size=0

I tried to set up this configuration on server.conf :

[queue]
maxSize = 10MB

[queue:my_syslog_group]
maxSize = 10MB

After restarting, I have always the default queue (97 KB). I saw nothing in the outputs.conf file to increase this queue for syslog output.

Do you have any idea ?

Thx for your help,

Regards,

Ludo

Tags (3)

kozanic_mg
Explorer

Hi All,

Just wondering if anyone has been able to come up with a fix / work-around for this issue.

It's 5 yrs since it was originally asked and still it appears that the config options are very limited for this.

0 Karma

harishmeetsu
Explorer

Hi,

Did you find any solution for this? Unfortunately I cannot see any option to drop events when queue full for the syslog output processor

 

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @harishmeetsu,

I had a problem few months ago related to this: i tried to enlarge the maxQueueSize and my system was blocked because the full syslog queue blocked all the other queues(I was working on an Heavy Forwarder).

I opened a case to Splunk Support and they gave me two solutions:

  • using the parallel ingestion and add more resources to the system,
  • writing data in a file and using r-syslog.

I followed their first hint and I was able to send more data via syslog (around 20kb/s instead 1).

To do this, you have to add to your server.conf:

[general]
parallelIngestionPipelines = 2

Before you ask: it isn't possible to use an higher value, I tried without results!

Ciao.

Giuseppe

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Your configuration option is wrong and needs to be on the outputs.conf configuration for the syslog.

maxQueueSize = [<integer>|<integer>[KB|MB|GB]|auto]

See:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf
0 Karma

ludoz13
Path Finder

Hello alacercogitatus,

Thanks for your answser but could you please confirm us that this option setting "maxQueueSize" is for Syslog output.

I see on the documentation that this option is only for TCP output (splunk system)

Thanks a lot,

Regards,

Ludo

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...