<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I raised issue on an existing bug on the github tracker, but it
seems to have gone unnoticed, so I'm repeating it here to try and
get some attention on the issue.<br>
<br>
Using multi-line-mode without the multi-line-suffix option WILL
result in message loss.<br>
When syslog-ng is running in multi-line-mode, it buffers multi-line
messages until it sees the start of a new message. When it sees the
start of a new message, it flushes the buffered message, and puts
the first line of the new message in the buffer. However if
syslog-ng shuts down, or receives a SIGHUP (reload), any lines
currently buffered are discarded. Given that syslog-ng can't stay
running forever, and it will get shut down or SIGHUPd eventually,
using this feature will result in messages getting lost.<br>
<br>
The message on the github issue where I brought this up is: <a
class="moz-txt-link-freetext"
href="https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887"><a class="moz-txt-link-freetext" href="https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887">https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887</a></a><br>
<br>
-Patrick<br>
</body>
</html>