<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
If the problem is <span id="result_box" class="short_text"
lang="en"><span title="Kattintson más fordításokhoz" class="hps">permanent
after using Sandor solution as well, maybe</span></span> you
should use flow-control in server, because it can happen that the
client syslog-ng will forward the logs as fast as it can, but the
server will drop the incoming lines if it cannot process them in
time and all buffers are full.<br>
<br>
Use this config:<br>
<br>
<span class="403004113-09032011">
<div><font face="Courier New">log {<br>
source(s_mysrc);</font></div>
<div><font><span class="403004113-09032011"></span><font
face="Courier New">f<span class="403004113-09032011">ilter(f_filter);<br>
flags(flow-control);<br>
</span>destination(d_mydest);<br>
};</font></font></div>
</span><br>
<br>
On 2011-03-09 15:49, Sandor Geller wrote:
<blockquote
cite="mid:AANLkTikeY_9TiouJhuZ1n8rom=MTVXSCsUvqipP2n0Ef@mail.gmail.com"
type="cite">
<pre wrap="">Hi,
On Wed, Mar 9, 2011 at 2:50 PM, Hidayath Basha
<a class="moz-txt-link-rfc2396E" href="mailto:hidayath.basha@saventech.com"><hidayath.basha@saventech.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi all,
I'm trying to transmit a huge log file (of about 80k lines) to a centralized
syslog server over TCP
</pre>
</blockquote>
<pre wrap="">
80k lines is piece of cake unless the average line length is quite big :)
</pre>
<blockquote type="cite">
<pre wrap="">But, on the syslog server, I'm receiver only the last part of the log file
(of about 7000 lines)
How can I transmit the whole log file
</pre>
</blockquote>
<pre wrap="">
syslog-ng keeps track where it left off reading a file to avoid
sending the whole file again when it gets restarted so my guess is
that you fired up syslog-ng a few times.
To confirm this could you stop syslog-ng, delete
/var/lib/syslog-ng.persist (or where your persist file lives) and
start syslog-ng?
If the problem persists then run syslog-ng under strace and show the
relevant parts (file opens, seeks, reads).
Regards,
Sandor
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
</body>
</html>