[syslog-ng] Odd behavior with very small log_fifo_size()

[Carlos Carvalho]

Balazs Scheidler (bazsi at balabit.hu) wrote on 2 July 2008 11:13:
 >syslog-ng does not log message loss on file destinations, because that'd
 >clutter the log statistics line, on the asssumption that no messages are
 >can be lost there.
 >
 >However this is not always the case, if you log_fifo_size() is smaller
 >than the window size of incoming sources, messages can be lost.
 >
 >Here is a description of how flow-control and window sizes work in
 >syslog-ng:
 >
 >http://www.balabit.hu/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html
 >
 >Please let me (and the doc team) know if the description could be made
 >clearer somehow.

I found this part confusing:

   The syslog-ng application monitors (polls) the sources defined in
   its configuration file, periodically checking each source for
   messages. When a log message is found in one of the sources,
   syslog-ng polls every source and reads the available messages.

This means it breaks the periodicity of the checks, because when it
finds something in one source it checks the others immediately. Is
this true? If it is it doesn't look very useful because each source
should be polled frequently enough independently of the others.