<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body ><div><br></div><div>If desired, could a "zero-counters" be added to syslog-ng-ctl ?</div><div><br></div><div>Not critical but maybe useful for troubleshooting. </div><div><br></div><div>Jim</div><div><br></div><div><div style="font-size:75%;color:#575757">Sent from my Verizon Wireless 4G LTE Smartphone</div></div> <br><br><br>-------- Original message --------<br>From: Gergely Nagy <algernon@balabit.hu> <br>Date: 11/20/2013 8:47 AM (GMT-05:00) <br>To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> <br>Cc: syslog-ng-dev-l@balabit.hu <br>Subject: Re: [syslog-ng] [review request] 3.6queue/f/stats-reset <br> <br><br>Balazs Scheidler <bazsi77@gmail.com> writes:<br><br>> On Mon, 2013-11-18 at 18:22 +0100, Gergely Nagy wrote:<br>>> Evan Rempel <erempel@uvic.ca> writes:<br>>> <br>>> > Perhaps the same logic can be used to identify those counters that have expired meaning that the stats-lifetime() has been exceeded,but<br>>> > instead of dropping the stat counter at that time, the counter is just flagged for dropping.<br>>> ><br>>> > Then it becomes the job of the statistics logging, based on the stats-freq() value, to log AND drop those counters that<br>>> > have been flagged as having exceeded the stats-lifetime().<br>>> ><br>>> > This way a counter is never dropped until it has exceeded the<br>>> > stats-lifetime() AND has been logged.<br>>> <br>>> That makes a lot of sense, but syslog-ng-ctl stats should not count (or<br>>> perhaps only with a flag), precisely to avoid the scenario you outlined<br>>> too.<br>>> <br>><br>> This really makes sense, however my issue is that stats-freq() is often<br>> set to 0 which disables the Log statistics message currently. Relying<br>> the cleanup mechanism on that would disable cleanup altogether in a lot<br>> of setups.<br>><br>> hmm... maybe we should use stats-freq() if that's nonzero and<br>> stats-lifetime() when it is zero. This way the cleanup mechanism would<br>> kick in, without the risk of losing messages.<br>><br>> syslog-ng-ctl stats wouldn't prune counters.<br>><br>> This way, stats-freq() would be the one which actually clears counters,<br>> we get rid of an additional iteration over the set of counters.<br>><br>> This paves the way for an improved log statistics message that could be<br>> sent into graphite/logstash/whatever graphing application via standard<br>> syslog-ng destination drivers, and all this without the risk of losing<br>> counters.<br>><br>> What do you think?<br><br>Sounds very good to me. This is a big step towards what I need, and is<br>simple enough to understand too.<br><br>-- <br>|8]<br><br>______________________________________________________________________________<br>Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<br>FAQ: http://www.balabit.com/wiki/syslog-ng-faq<br><br></body>