SocketBacklog

Sets the listen() backlog for pending TCP connections.

This parameter applies to imptcp: Plain TCP Syslog.

Name:

SocketBacklog

Scope:

input

Type:

integer

Default:

input=64

Required?:

no

Introduced:

at least 5.x, possibly earlier

Description

Specifies the backlog parameter passed to the listen() system call. This parameter defines the maximum length of the queue for pending connections, which includes partially established connections (those in the SYN-ACK handshake phase) and fully established connections waiting to be accepted by the application.

For more details, refer to the listen(2) man page.

By default, the value is set to 64 to accommodate modern workloads. It can be adjusted to suit specific requirements, such as:

  • High rates of concurrent connection attempts: Increasing this value helps handle bursts of incoming connections without dropping them.

  • Test environments with connection flooding: Larger values are recommended to prevent SYN queue overflow.

  • Servers with low traffic: Lower values may be used to reduce memory usage.

The effective backlog size is influenced by system-wide kernel settings, particularly net.core.somaxconn and net.ipv4.tcp_max_syn_backlog. The smaller value between this parameter and the kernel limits is used as the actual backlog.

Input usage

input(type="imptcp" socketBacklog="...")

See also

See also imptcp: Plain TCP Syslog.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.