<div dir="ltr">I talked to algernon in IRC yesterday:<div><div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><span class="" style="display:inline">[14:33] </span><<span class="" style>iroller_</span>> algernon: could you explain please what happens when syslog-ng stops reading the source(flow-control enabled)? As I understand if the source is "file()" it will stop reading it at current position and will continue later at the same postition, right? What if I have tcp source where my app is sending logs all the time?</div>
<div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><span class="" style="display:inline">[14:39] </span><<span class="" style="color:red">algernon</span>> iroller_: in case of tcp(), it will stop reading from there, kernel buffers will fill up, and the remote end will slow down. if messages pile up there, and fill the sending syslogd's buffers, then they'll likely be dropped on that side</div>
<div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><span class="" style="display:inline">[14:40] </span><<span class="" style>iroller_</span>> algernon: so by enabling flow-control we're just switching from syslog-ng's fifo buffer to kernel buffers, right?</div>
<div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><span class="" style="display:inline">[14:41] </span><<span class="" style>algernon</span>> as far as I understand, yes. (I'm not using flow control anywhere, and my knowledge of how it works in syslog-ng is a bit rusty, unfortunately)</div>
<div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><span class="" style="display:inline">[14:44] </span><<span class="" style>iroller_</span>> we need more balabit guys here :)</div>
</div><div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px"><br></div><div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px">
<br></div><div class="" style="font-family:Consolas,'Lucida Console',monospace;padding-left:7px;word-wrap:break-word;color:rgb(0,0,0);font-size:13px">Bazsi, could you please give some more information on it? What's the purpose of switching from fifo to kernel buffers?</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jan 8, 2013 at 4:38 PM, Anton Koldaev <span dir="ltr"><<a href="mailto:koldaevav@gmail.com" target="_blank">koldaevav@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">For example at one moment of time I see the following values(with flow-control disabled):<div>dst_syslog.total.stored: 10000 (msg)</div>
<div>dst_syslog.total.dropped: 12179 (msg per min)</div>
<div>dst_syslog.total.processed: 183800 (msg per min)</div><div><br></div><div>How should flow-control help me here?</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Jan 8, 2013 at 4:15 PM, Anton Koldaev <span dir="ltr"><<a href="mailto:koldaevav@gmail.com" target="_blank">koldaevav@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">As I understand syslog-ng will buffer the lines in buffer until it can process them, right? Which buffer?</div>
<div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jan 8, 2013 at 4:10 PM, Anton Koldaev <span dir="ltr"><<a href="mailto:koldaevav@gmail.com" target="_blank">koldaevav@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Could you please explain the following statement:<div><span style="line-height:14px;text-align:justify;font-size:12px;font-family:Arial,Helvetica,sans-serif">> If the control window is full, syslog-ng stops reading messages from the source until some messages are successfully sent to the destination.</span><br clear="all">
<div><br></div><div>What does that mean - "stops reading messages from the source"? My applications is still sending messages to this souce so where will all the logs at that moment?</div><div>Where will it start reading the source? From the same point it stopped or not?</div>
<span><font color="#888888">
<div><br></div>-- <br>Best regards,<br>Koldaev Anton
</font></span></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Koldaev Anton
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Koldaev Anton
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Koldaev Anton
</div>