Advanced Interface Options

Each network interface (UDP, TCP, or TLS) has an Advanced section with low-level transport settings. The initial values suit most cases; change them only to solve a specific problem.

Open the interface in Syslog Collector Configuration, then expand Advanced.

Any Interface

Field Initial Description

Maximum message length

10000

Maximum length of one syslog message, in bytes (3–65515). UDP: a longer datagram is dropped. TCP and TLS: a longer message is truncated, and the client is disconnected to resynchronize the stream; a warning is written to Diagnostic Records.

Socket buffer size (bytes)

2000000

Size of the operating system receive buffer for this listener, used to absorb data bursts (0–268435455). 0 uses the system default.

When to Adjust

If messages are cut off or missing, or TCP/TLS clients are disconnected with a truncation warning, increase Maximum message length. Originators that send large structured data or verbose application payloads can exceed the initial limit.

Change Socket buffer size only when the server receives more than about 10,000 messages per second over UDP and messages are lost during bursts. Contact technical support before changing it: the right size depends on Windows limits, available memory, and the message rate.

Streaming (TCP/TLS) Interface

These settings apply only to TCP and TLS. UDP has no byte stream and no client sessions.

Field Initial Description

Octet-counting detection

Yes

Detect RFC 6587 octet-counting framing (each message prefixed with its length). With Yes, both octet-counted and delimiter-separated streams are accepted. Turn it off only for compatibility with legacy equipment.

Split stream using CR/LF

Yes

Yes splits the stream into messages on CR, LF, and \0. No splits on \0 only — for originators that send multi-line messages terminated by \0.

Inactive client timeout

Disabled

Disconnect clients that send nothing for this many seconds. 0 (shown as Disabled) keeps idle clients connected.

When to Adjust

Keep Octet-counting detection and Split stream using CR/LF on unless messages arrive merged together or split in the wrong places.

Inactive client timeout helps when many originators connect and disconnect over time, so that idle sessions do not fill up Maximum concurrent connections. For a fixed set of originators, leave it disabled.

Related Topics