[Fwd: [syslog-ng]Full pipe as destination]

[Brad Arlt]

On Tue, Aug 21, 2001 at 02:16:09PM +0200, Balazs Scheidler wrote:
> On Tue, Aug 21, 2001 at 01:26:27PM +0200, Peter Draexler wrote:
> > Peter Draexler schrieb:
> > 
> > > Dear Bazsi,
> > > thank you for your info. This should help.
> > > Nevertheless, does syslog-ng log somewhere if it discards events or do you know
> > > another way to check this?
> > > This would be important to adapt log_fifo_size. Currently we only observe by
> > > chance that we lose  information.
> 
> logs are silently dropped in this case. I was thinking of implementing some
> kind of automatic statistics message to report log losses, but that would
> race against normal log traffic. do you have a better idea.

A single message saying "log queue full" written to the syslog facilty
at emerg would due it.  And rather than compete have it win the race
always.  Since we are already losing messages, it is more important
that we know we are losing messages than to know what messages have
been lost (if that makes sense).

One could also have a seperate "oh shit!" log file that only gets
written to by syslog-ng internals and not through standard mechanisms.
A non-blocking write(2) could be used to ensure that these messages
didn't impeed on other logging (much).

The only other thing I can think of is a message to the console
(/dev/console or /dev/sysmsg, these may be Solaris isms though :) to
force the message to appear on the console without going through the
normal syslog methods (or maybe that is the normal syslog method).
This isn't a terribly great solution, but at least one could say "Hey!
That doesn't look right" on the daily stroll through the machine room.

Also, an "everything is OK" error message when the queue fixes itself
would be nice to see, but perhaps not a terribly good idea.  The idea
was to see when trouble started and when it stopped.  Barring anything
better, this information would be very handy in a forensic situation.

----------------------------------------------------------------------------
   __o		Bradley Arlt	  Email: arlt@cpsc.ucalgary.ca         o__
 _ \<_				    WWW: www.acs.ucalgary.ca/~bdarlt   _>/ _
(_)/(_)  -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)