<html>
<head>
<meta content="text/html; charset=us-ascii"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">You could also look at the apache FLUME
project.<br>
It has reliable transport and could accept data from syslog-ng,
although it<br>
can not read data directly from the syslog kernel channels, and<br>
there would still not be any verification that t=syslog-ng got its
message<br>
to fluke. The likelihood would be that it would sinde syslog-ng
and FLUKE could run on the same host.<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=us-ascii">
<b style="color: rgb(0, 102, 33); font-family: arial, sans-serif;
font-size: 14px; font-style: normal; font-variant: normal;
letter-spacing: normal; line-height: 16px; orphans: 2;
text-align: -webkit-auto; text-indent: 0px; text-transform:
none; white-space: nowrap; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); "><a class="moz-txt-link-freetext" href="https://flume">https://flume</a></b><span
style="color: rgb(0, 102, 33); font-family: arial, sans-serif;
font-size: 14px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height: 16px;
orphans: 2; text-align: -webkit-auto; text-indent: 0px;
text-transform: none; white-space: nowrap; widows: 2;
word-spacing: 0px; -webkit-text-size-adjust: auto;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); display: inline !important; float: none; ">.</span><b
style="color: rgb(0, 102, 33); font-family: arial, sans-serif;
font-size: 14px; font-style: normal; font-variant: normal;
letter-spacing: normal; line-height: 16px; orphans: 2;
text-align: -webkit-auto; text-indent: 0px; text-transform:
none; white-space: nowrap; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); ">apache</b><span
style="color: rgb(0, 102, 33); font-family: arial, sans-serif;
font-size: 14px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height: 16px;
orphans: 2; text-align: -webkit-auto; text-indent: 0px;
text-transform: none; white-space: nowrap; widows: 2;
word-spacing: 0px; -webkit-text-size-adjust: auto;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); display: inline !important; float: none; ">.org</span><br>
<br>
Evan.<br>
<br>
On 11/25/2013 03:19 PM, Malkin, Vlad wrote:<br>
</div>
<blockquote
cite="mid:C769C539D341954CB0F13483CF2BC546F8AEF8@wdc1exchmbxp05.hq.corp.viasat.com"
type="cite">
<pre wrap="">Balazs,
Thank you very much!
--Vlad
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> [<a class="moz-txt-link-freetext" href="mailto:syslog-ng-bounces@lists.balabit.hu">mailto:syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Balazs Scheidler
Sent: Tuesday, November 19, 2013 5:24 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Syslog-ng OSE Question.
On Mon, 2013-11-18 at 16:00 +0000, Malkin, Vlad wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Thank you for responding!
I'm not as much concerned with the reliability on-the-wire, TCP is good enough to detect most network issues. There is a loose assumption that if the message gets to the stack on the server side, the server will be able to get the data, i.e. it in itself had not failed. But leaving all that aside, what I'm really after is when syslog-ng client sends a message and it "believes" that it has been successfully sent, how could a call back to another process be inserted? Should hard flow control be used between message producer and the syslog-ng, I'm assuming that the client will stop reading from the producer if it is unable to send, correct?
If we wanted to insert code in syslog-ng to call another process upon successful message send, do you know where that would need to be?
</pre>
</blockquote>
<pre wrap="">
in the in-process acknowledgement path.
log_source_msg_ack() is the final ACK callback that increments the window and awakens the souce if it went to sleep because of the lack of window space.
But calling out to an external process is resource hungry, syslog-ng is able to process hundreds of thousands of messages per second, with a fork/exec like that I'd guess it wouldn't be more than a couple of thousands.
</pre>
<blockquote type="cite">
<pre wrap="">
Thank you!
--Vlad
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>
[<a class="moz-txt-link-freetext" href="mailto:syslog-ng-bounces@lists.balabit.hu">mailto:syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of Gergely Nagy
Sent: Monday, November 18, 2013 3:49 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Syslog-ng OSE Question.
"Malkin, Vlad" <a class="moz-txt-link-rfc2396E" href="mailto:Vlad.Malkin@viasat.com"><Vlad.Malkin@viasat.com></a> writes:
</pre>
<blockquote type="cite">
<pre wrap="">Is it possible to have syslog-ng client to invoke an external (to
it) software to acknowledge when each individual log statement is
sent to the server?
</pre>
</blockquote>
<pre wrap="">
No, it's not possible to do that, but read below.
</pre>
<blockquote type="cite">
<pre wrap="">Background: logs should not be lost. The system needs to store logs
internally until they are transmitted to the server (use of TCP
transport provides a level of reliable delivery). After each log
statement is transmitted by syslog-ng client, it needs to be removed
from internal store to preserve allocated space.
</pre>
</blockquote>
<pre wrap="">
This is something that syslog-ng PE can do for you (albeit still not allowing you to use an external program for ACKing) by way of its RLTP protocol and disk buffering.
Other than that, using something like AMQP with durability and persistance on would be closest to what you want, but that still allows a narrow window where messages can get lost.
</pre>
</blockquote>
<pre wrap="">
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
</body>
</html>