Advanced Interface Options

Each network interface (UDP, TCP, or TLS) exposes an Advanced section with low-level transport tuning. Leave these values unless a specific problem requires a change.

Open the interface in Syslog Collector Configuration, then expand Advanced.

Any Interface

These settings apply to UDP, TCP, and TLS interfaces.

Field	Initial	Description
Maximum message length	10000	Maximum number of bytes accepted per syslog message. Messages exceeding this length are truncated or dropped depending on the transport.
Socket buffer size (bytes)	2000000	Size of the OS socket receive buffer. Larger values reduce packet loss during traffic bursts at the cost of more kernel memory.

Field

Initial

Description

Maximum message length

10000

Maximum number of bytes accepted per syslog message. Messages exceeding this length are truncated or dropped depending on the transport.

Socket buffer size (bytes)

2000000

Size of the OS socket receive buffer. Larger values reduce packet loss during traffic bursts at the cost of more kernel memory.

When to Adjust These Settings

If syslog messages are cropped or truncated, increase Maximum message length. Originators that send long messages (for example, with large structured data or verbose application payloads) may exceed the initial limit.

Change Socket buffer size only when the server handles more than about 10,000 syslog messages per second and messages appear to be lost during bursts. Even then, consult technical support before changing this value — the right size depends on OS limits, memory, and how the collector is deployed.

Streaming (TCP/TLS) Interface

These settings apply only to TCP and TLS interfaces. UDP is connectionless and has no stream framing or client sessions, so they do not appear for UDP.

Field	Initial	Description
Octet-counting detection	Yes	Detect RFC 6587 "octet counting" framing on TCP/TLS streams. When enabled, the server can accept either octet-counted or newline-delimited framing automatically.
Split stream using CR/LF	Yes	Split the TCP/TLS byte stream into individual messages on CR/LF boundaries. Disable only if the originator uses a different delimiter.
Inactive clients timeout	Disabled	Disconnect TCP/TLS clients that send no data for the configured period. Disabled keeps idle connections open indefinitely.

Field

Initial

Description

Octet-counting detection

Yes

Detect RFC 6587 "octet counting" framing on TCP/TLS streams. When enabled, the server can accept either octet-counted or newline-delimited framing automatically.

Split stream using CR/LF

Yes

Split the TCP/TLS byte stream into individual messages on CR/LF boundaries. Disable only if the originator uses a different delimiter.

Inactive clients timeout

Disabled

Disconnect TCP/TLS clients that send no data for the configured period. Disabled keeps idle connections open indefinitely.

When to Adjust These Settings

Octet-counting detection and Split stream using CR/LF almost always stay enabled. Disable them only in rare cases — for example when messages arrive mixed or stuck together and the default framing no longer separates them correctly.

Inactive clients timeout can help when many syslog originators connect and disconnect over time, so idle TCP/TLS sessions do not accumulate. For a fixed, known set of originators, Disabled is usually enough.