<p dir="ltr">Flush-lines controls the maximum buffer size, but syslog-ng will automatically flush if there's no input. So you will see one message at a time unless messages are streaming in at a high pace.</p>
<p dir="ltr">Flush-lines used to work differently, but was changed when syslog-ng became multithreaded.</p>
<p dir="ltr">What is your usecase where this might be needed?</p>
<div class="gmail_quote">On Oct 15, 2015 6:31 AM, "伊藤 宏平" <<a href="mailto:ki0412@hotmail.com">ki0412@hotmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr"><div>Thank you for your advice.</div><div>I tried you options.</div><div>But the problem is same.</div><div><br></div>I use options below.<div><br></div><div><div>options {</div><div> chain_hostnames(off);</div><div> flush_lines(3);</div><div> flush_timeout(5);</div><div> use_dns(no);</div><div> use_fqdn(no);</div><div> owner("root");</div><div> group("adm");</div><div> perm(0640);</div><div> stats_freq(600);</div><div> bad_hostname("^gconfd$");</div><div>};</div><div><br></div><div>I try to catch log by tail command.</div><div>like this "<span style="font-size:12pt">$sudo tail -f /var/log/messages"</span></div><div><br></div><div>I expected to 3 line show at a time.</div><div><span style="font-size:12pt">But log shows one by one, when I call logger command.</span></div><div><span style="font-size:12pt"><br></span></div><div><span style="font-size:12pt">Could you confirm that the log shows at once? Or one by one?</span></div><div><span style="font-size:12pt"><br></span></div><div>thanks!</div><div><br></div><div><br></div><div><hr>To: <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>From: <a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a><br>Date: Wed, 14 Oct 2015 20:01:54 -0700<br>Subject: Re: [syslog-ng] Is the option flush_lines valid now?<br><br>
<div>What happens when you try to use the
option.<br>
<br>
I use it with syslog-ng 3.7.1<br>
<br>
options {<br>
log_fifo_size(20000000);<br>
use_fqdn(yes);<br>
keep_hostname(yes);<br>
chain_hostnames(yes);<br>
time_reap(60);<br>
time_reopen(5);<br>
flush_lines(15000);<br>
flush_timeout(2000);<br>
stats_level(1);<br>
log_msg_size(16384);<br>
};<br>
<br>
<br>
without any problems.<br>
<br>
<br>
On 10/14/2015 04:35 PM, 伊藤 宏平 wrote:<br>
</div>
<blockquote>
<div dir="ltr">I tried to use syslog-ng.
<div><br>
</div>
<div>At first I used a syslog-ng 3.5.3 on <span style="color:rgb(34,34,34);font-family:'Helvetica Neue',Helvetica,Arial,sans-serif;font-size:15px;line-height:19.5px;background-color:rgb(255,255,255)">ubuntu14.04.</span></div>
<div>But I can not use flush_line option.</div>
<div><br>
</div>
<div><span style="font-size:12pt">I asked question in stack
overflow.</span></div>
<div>Mr.argus said that " There is a lack of condition"</div>
<div><a href="http://ja.stackoverflow.com/questions/12836/syslog-ng-%E3%81%AE-flush-lines-%E3%82%AA%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%8C%E5%8A%B9%E3%81%8B%E3%81%AA%E3%81%84" target="_blank">linux
- syslog-ng の flush_lines オプションが効かない - スタック・オーバーフロー</a></div>
<div><br>
</div>
<div>Specifically function "<span style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit;font-size:13px;background-color:rgb(238,238,238)">log_writer_flush"</span><span style="font-size:12pt"> should be like that.</span></div>
<div><span style="font-size:12pt"><br>
</span></div>
<div><span style="font-size:12pt">Before:</span></div>
<div><span style="font-size:12pt"><br>
</span></div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238)"><code style="padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit"><span style="padding:0px;border:0px;color:rgb(0,0,0)">gboolean
log_writer_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(43,145,175)">LogWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">*</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">self</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">,</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(43,145,175)">LogWriterFlushMode</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> flush_mode</span><span style="padding:0px">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">:</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">flush_mode </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> LW_FLUSH_BUFFER </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">||</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> count </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">==</span><span style="padding:0px;border:0px"> </span><span style="padding:0px;border:0px;color:rgb(128,0,0)">0</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">log_proto_client_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> LPS_ER!
ROR</span>
<span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">return</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> FALSE</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">}</span></code></pre>
</div>
<div>After:</div>
<div><br>
</div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238)"><code style="padding:0px;border:0px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;white-space:inherit"><span style="padding:0px;border:0px;color:rgb(43,145,175)">LogProtoFileWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">*</span><span style="border:0px;color:rgb(0,0,0)">w </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">=</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(43,145,175)">LogProtoFileWriter</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">*)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">w</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">-></span><span style="padding:0px;border:0px;color:rgb(0,0,0)">buf_count </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> w</span><span>-></span><span style="padding:0px;border:0px;color:rgb(0,0,0)">buf_size</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">&&</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">flush_mode </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">>=</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> LW_FLUSH_BUFFER </span><span>||</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> count </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(128,0,0)">0</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">{</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">if</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">log_proto_client_flush</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">(</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">proto</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> </span><span style="padding:0px;border:0px;color:rgb(0,0,0)">==</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> LPS_ER!
ROR</span>
<span style="padding:0px;border:0px;color:rgb(0,0,0)">)</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,139)">return</span><span style="padding:0px;border:0px;color:rgb(0,0,0)"> FALSE</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">;</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">
</span><span style="padding:0px;border:0px;color:rgb(0,0,0)">}</span></code></pre>
</div>
<div><span style="font-size:12pt"><br>
</span></div>
<div><span style="font-size:12pt">And now I use a latest
syslog-ng ose 3.7.1, hoping the bug has been fixed.</span></div>
<div><span style="font-size:12pt">But I can not use flush_line
option either.</span></div>
<div><span style="font-size:12pt"><br>
</span></div>
<div><span style="font-size:12pt">Is the option flush_lines
valid now?</span></div>
<div>
<pre style="padding:5px;border:0px;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,sans-serif;color:rgb(57,51,24);word-wrap:normal;background-color:rgb(238,238,238)"></pre>
</div>
<div>
<div><u></u><u></u></div>
<div>
<u></u>
<div>
<u></u>
<div> <span></span> </div>
<div> <span> try </span> <span> (動) </span>
<span>
試みる、努める、努力する、試す、挑む、見る、審理する </span> <br>
</div>
<div> <span></span> </div>
<u></u>
<u></u>
<div> <span></span> </div>
<div> <span> tried </span> <span> (形)
</span> <span>
検査済みの、証明済みの、試験済みの </span> <br>
</div>
<div> <span></span> </div>
<u></u>
</div>
<u></u>
<u></u> <a href="http://iknow.jp" target="_blank"> Powered by <span>iKnow!</span> </a>
<u></u>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>This body part will be downloaded on demand.</pre>
</blockquote>
<br>
<br>______________________________________________________________________________
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a></div></div><div style="display:block"><div><u></u><u></u></div><div><u></u>
<div>
<u></u>
<div>
<span></span>
</div>
<div>
<span>
advice
</span>
<span>
(名)
</span>
<span>
助言、アドバイス、勧め
</span>
<br>
</div>
<div>
<span></span>
</div>
<u></u>
</div>
<u></u>
<u></u>
<a href="http://iknow.jp" target="_blank">
Powered by <span>iKnow!</span>
</a>
<u></u>
</div></div> </div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>