clarify the error message when log_iw_size is too small

[burr86]

It turns out that this error is resolved only by setting log_iw_size
and max_connections. Make the error message reflect that, and provide
guidance as to the right settings to adjust.

[algernon]

This looks good to me, but I'd like an ACK from @bazsi, before I merge it.

[bazsi]

Hmm... it is log_fifo_size() that needs adjusting. Since we increased log_iw_size() automatically, it may happen
that the originally set log_fifo_size() is too small to hold log_iw_size() elements from all sources that feed that destination.

I intend to make window/fifo sizing automatic, but we are not there yet :( Defaults are usually ok, finetuning now requires understanding the syslog-ng flow-control behaviour (window on source side, fifo on destination side; fifo must be large enough to hold log_iw_size() elements from all its sources).

[bazsi]

all in all, the last sentence should not be removed, adjusting log_iw_size() can only make the warning go away, not the problem itself.

[burr86]

I think I understand what you're saying, but it's confusing, because the section of the config that throws the warning (the sources) isn't the section of the config that you would adjust to fix the problem. Ultimately I'm hoping to make the warning offer clearer guidance to a resolution. I couldn't find any other way besides adjusting log_iw_size() ... are you saying that we should both adjust log_iw_size(), but beyond that, log_fifo_size() needs to change too? Can we check for both and warn against both?

[burr86]

Alternately: maybe these are two different issues? Fixing the actual math/warning might be separate from proper window tuning?

[bazsi]

it would be much more to check if log_fifo_size is actually missized and report on that and suggest fixes.

once we have that we can probably continue with automatic sizing as well.

[burr86]

I guess I don't understand how we can know that, at this point in the code -- we're just analyzing sources, here, not destinations also?

[bazsi]

that's exactly the difficulty. in order to provide the most relevant warning we would need to analyze both sides.

[abalage]

FYI
This one helped me: http://if.andonlyif.net/blog/2013/06/magic-numbers-and-tuning-syslog-ng.html

[PaulAnton]

an explanation of how to solve it would be helpful. I had to do a couple of tests to figure things out.
"tcp windows size per connection=(log_iw_size)/(max-connections). And that a arbitary value for log_iw_size can be mentioned in the source definition where max-connections is mentioned Eg: 'max-connections(5000) log_iw_size(500000)' means a tcp window size per conection is 100 bytes. If it is equal to or more than 100 bytes there won't be any warnings"