From 37a3bed839f2d9bb009ee719ce7d48ad15c26625 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Thu, 2 Apr 2020 07:51:07 -0400 Subject: [PATCH] Add doc for SC4S_SOURCE_LISTEN_UDP_SOCKETS --- docs/configuration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/configuration.md b/docs/configuration.md index ec1569d..66f96ae 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -103,6 +103,7 @@ and/or move them to an archival system to avoid exhaustion of disk space. | SC4S_SOURCE_TCP_IW_SIZE | 20000000 | Initial Window size | | SC4S_SOURCE_TCP_FETCH_LIMIT | 2000 | Number of events to fetch from server buffer at once | | SC4S_SOURCE_UDP_SO_RCVBUFF | 1703936 | UDP server buffer size in bytes. Make sure that the host OS kernel is configured [similarly](gettingstarted/index.md#prerequisites). | +| SC4S_SOURCE_LISTEN_UDP_SOCKETS | 5 | Number of virtual listeners per active UDP port this has the effect of increasing the buffer as a multiple of SC4S_SOURCE_LISTEN_UDP_SOCKETS * SC4S_SOURCE_UDP_SO_RCVBUFF | | SC4S_SOURCE_STORE_RAWMSG | undefined or "no" | Store unprocessed "on the wire" raw message in the RAWMSG macro for use with the "fallback" sourcetype. Do _not_ set this in production; substantial memory and disk overhead will result. Use for log path/filter development only. | ## Syslog Source TLS Certificate Configuration