<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div style="font-family: 'Calibri', 'sans-serif';">
<div dir="ltr">
<div dir="ltr">Hi,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">opening a new issue is not necessary.</div>
<div dir="ltr">I hope that a GSoC student will solve this issue.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">BTW GSoC: we are still looking for feature owners to our GSoC[1]<span style="line-height: 22.4px;"> projects[2]. As an experienced syslog-ng user you could join to us. What do you think?</span></div>
<div dir="ltr"><br>
</div>
<div dir="ltr">[1] <a href="https://syslog-ng.org/gsoc-2016/">https://syslog-ng.org/gsoc-2016/</a></div>
<div dir="ltr">[2] <a href="https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html">https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html</a></div>
<div dir="ltr"><br>
</div>
<div dir="ltr">regards,</div>
<div dir="ltr">Laszlo Budai</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">
<div dir="ltr">Sent from my HTC</div>
</div>
</div>
<br>
<div id="htc_header">----- Reply message -----<br>
From: "Patrick Hemmer" <syslogng@stormcloud9.net><br>
To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu><br>
Subject: [syslog-ng] message loss using multi-line-mode<br>
Date: Tue, May 17, 2016 00:17</div>
</div>
<br>
<div style="background-color:#FFFFFF">Anybody? Should I open a new issue?<br>
<br>
-Patrick<br>
<br>
<div class="x_moz-cite-prefix">On 2016/3/28 12:01, Patrick Hemmer wrote:<br>
</div>
<blockquote type="cite">I raised issue on an existing bug on the github tracker, but it seems to have gone unnoticed, so I'm repeating it here to try and get some attention on the issue.<br>
<br>
Using multi-line-mode without the multi-line-suffix option WILL result in message loss.<br>
When syslog-ng is running in multi-line-mode, it buffers multi-line messages until it sees the start of a new message. When it sees the start of a new message, it flushes the buffered message, and puts the first line of the new message in the buffer. However
if syslog-ng shuts down, or receives a SIGHUP (reload), any lines currently buffered are discarded. Given that syslog-ng can't stay running forever, and it will get shut down or SIGHUPd eventually, using this feature will result in messages getting lost.<br>
<br>
The message on the github issue where I brought this up is: <a class="x_moz-txt-link-freetext" href="https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887">
</a><a class="x_moz-txt-link-freetext" href="https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887">https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887</a><br>
<br>
-Patrick<br>
<br>
<fieldset class="x_mimeAttachmentHeader"></fieldset> <br>
<pre>______________________________________________________________________________
Member info: <a class="x_moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="x_moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="x_moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
<br>
</div>
</body>
</html>