log error

[ohassairi]

dears

i am receiving this error from our WSA. i wonder how WSA detects this problem because syslog is udp? and what solution can we do to avaoid it?

Log Error: Subscription accesslogs: Syslog internal buffer overflow.

Some data may be dropped. This may be because server x.x.x.x (unknown) is not accepting data fast enough or because data is being generated more quickly than can be accomodated by the syslog protocol.

[Tao Yang]

If you use TCP for Syslog push, you can configure the syslog disk buffer size in command line, CLI>logconfig, here are corresponding configurations.

Enable syslog disk buffer (yes/no)

[no]> yes

Syslog disk buffer size (in bytes)

[100M]>

Syslog will use the disk buffer if there is a network connectivity  issue between WSA and remote syslog server. Therefore usually this kind of error indicates there is a issue between WSA and syslog server.

[ohassairi]

actually we are using UDP and not TCP. that's why i wonder how WSA detects this problem?