[syslog-ng]TCP transport reliability

[Jeffrey W. Baker]

On Thu, 4 Jan 2001, Jon Marks wrote:

> Hello,
>
> I'm testing syslog-ng with TCP transport, and I'm a little surprised-
> perhaps I'm doing something wrong? I'm finding severe message loss,
> which I had imagined TCP would eliminate.

I've reported the same thing on this list in the past.  Indeed, my
machines can even lose messages when the input is a pipe and the output is
a local file!

The culprit is this bit of code at line 71 in libol:

        if (self->queue_size == self->queue_max) {
                /* fifo full */
                ol_string_free(string);
                return ST_FAIL | ST_OK;
        }

If the queue is full, your message is dismissed and cannot be recovered.
If you put a printf() statement in that code block, I bet you will see
that you are hitting this misfeature.  I tried fixing this problem, but
there is not a simple way.  It requires significant changes to syslog-ng's
message handling loop.

-jwb