Setting output queue size

Syslog-ng always reads its incoming log channels to prevent your running daemons from blocking. This may result in lost messages if the output queue is full. It's therefore important to set the output queue size (termed in number of messages), which you can do globally, or on a per destination basis.

	  options { log_fifo_size(1000); };
	
or
	  destination d_messages { file("/var/log/messages" log_fifo_size(1000)); };
	
You should set your fifo size to the estimated number of messages in a message burst. If bursts extend the bandwidth of your destination pipe, syslog-ng can feed messages into the destination pipe after the burst has collapsed.

Of course syslog-ng cannot widen your network bandwidth, so if your destination host lives on a noisy network, and your logtraffic extends the bandwidth of this network, syslog-ng can't do anything. It'll do its best however.