<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:TKTypeRegular;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Testo fumetto Carattere";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.TestofumettoCarattere
{mso-style-name:"Testo fumetto Carattere";
mso-style-priority:99;
mso-style-link:"Testo fumetto";
font-family:"Tahoma","sans-serif";
mso-fareast-language:IT;}
span.StileMessaggioDiPostaElettronica19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dear Janos,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">welcome back.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Actually the whole syslog-ng service is working fine now, the “rebel” network device (firewall) is sending its UDP logs to the new NIC of the server,
as expected.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I made some changes either to the server configuration and to the syslog-ng configuration before this result but I am not sure they were decisive.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">On the server I raised the rx and tx default ring buffer value for all the four NICs, from 256 to 2048, anyway the value of dropped packets was
low respect the amount of packets sent by device and ethtool does not show errors.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I raised the value of NIC ring buffer because when I run syslog-ng in debug mode, I did not see packets coming from that specific network device
entering syslog-ng, so I thought they were dropped.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">About syslog-ng configuration I deleted the @version row in every syslog-ng/conf.d/*.conf files I wrote and, but for another source driver, I dropped
few logs to the same destination changing them in a more articulated filter, so using an unique destination.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I restarted syslog-ng daemon and, then, I sent the logs of network device to the NIC added and, this time, it worked.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">May be it was only luck but now it works.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If I should have other news about the matter I will inform you, but I would be glad to know what do you think about the changes I made.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thank you very much.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Cheers<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-GB" style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:navy">Francesco Vincenti</span></b><b><span lang="EN-GB" style="color:navy"> <br>
</span></b><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Calibri","sans-serif";color:navy">RHCSA Area Data Center Open Source, Quality and Security</span></b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Calibri","sans-serif";color:navy"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:9.0pt;font-family:"Calibri","sans-serif";color:navy">Aspasiel
</span><span style="font-size:9.0pt;font-family:"Cambria","serif";color:navy">Divisione</span><span style="font-size:9.0pt;font-family:"Cambria","serif";color:#333399"> della Società</span><span style="font-size:8.0pt;color:#333399"><br>
</span><span style="font-size:9.0pt;font-family:"Calibri","sans-serif";color:#333399">Acciai Speciali Terni S.p.A. con Unico Socio</span><span style="font-size:8.0pt;color:navy"><br>
</span><span style="font-size:9.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Strada di Pentima, 3 – 05100 Terni</span><span style="font-size:8.0pt;font-family:TKTypeRegular;color:#1F497D">
</span><span style="font-size:8.0pt;font-family:TKTypeRegular;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:francesco.vincenti@acciaiterni.it"><span style="font-size:8.0pt;font-family:"Calibri","sans-serif"">francesco.vincenti@acciaiterni.it</span></a><span style="font-size:8.0pt;font-family:"Calibri","sans-serif";color:navy"><br>
</span><a href="http://www.aspasiel.it/"><span style="font-size:8.0pt;font-family:"Calibri","sans-serif"">www.aspasiel.it</span></a><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ufficio: +39 0744 203224<br>
Fax: +39 0744 203444</span><span style="font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Da:</span></b><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> syslog-ng [</span><a href="mailto:syslog-ng-bounces@lists.balabit.hu"><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">mailto:syslog-ng-bounces@lists.balabit.hu</span></a><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">]
<b>Per conto di </b>SZIGETVÁRI János<br>
<b>Inviato:</b> giovedì 3 agosto 2017 15:28<br>
<b>A:</b> Syslog-ng users' and developers' mailing list<br>
<b>Oggetto:</b> Re: [syslog-ng] UDP devices stop logging after network services restart.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">Dear Fancesco,<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Could you please upload the file for example to Google Drive/Dropbox/etc and share its link with us?<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US">Asking you to attach it to your reply might not have been my greatest idea.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Thank you!<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">János<br>
<br>
-- <o:p></o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Janos SZIGETVARI<br>
RHCE, License no. </span><a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank"><span lang="EN-US">150-053-692</span></a><span lang="EN-US"><br>
<br>
__@__˚V˚<br>
Make the switch to open (source) applications, protocols, formats now:<br>
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>
- msn -> jabber protocol (Pidgin, Google Talk)<br>
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal">2017-08-01 9:29 GMT+02:00 Vincenti Francesco <<a href="mailto:Francesco.Vincenti@acciaiterni.it" target="_blank">Francesco.Vincenti@acciaiterni.it</a>>:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Dear Janos<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">I already sent an email with the data you requested that is under analysis from your moderators because it is too big.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Anyway, every NIC has a number of dropped RX packages but either their number and their daily growth is not big enough to explain the amount of data lost.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Further, netstat –su shows, under UDP, 1 packet receive errors only.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">I’m going to switch UDP devices again to log on not-working NIC (ens35 according data I’ve sent to you) to verify how many packages are lost in this case and
I’ll inform you about the results.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US">Cheers<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-GB" style="font-size:10.0pt;color:navy">Francesco Vincenti</span></b><b><span lang="EN-GB" style="color:navy"> <br>
</span></b><b><span lang="EN-GB" style="font-size:8.0pt;color:navy">RHCSA Area Data Center Open Source, Quality and Security</span></b><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:9.0pt;color:navy">Aspasiel
</span><span style="font-size:9.0pt;font-family:"Cambria","serif";color:navy">Divisione</span><span style="font-size:9.0pt;font-family:"Cambria","serif";color:#333399"> della Società</span><span style="font-size:8.0pt;color:#333399"><br>
</span><span style="font-size:9.0pt;color:#333399">Acciai Speciali Terni S.p.A. con Unico Socio</span><span style="font-size:8.0pt;color:navy"><br>
</span><span style="font-size:9.0pt;color:#1F497D">Strada di Pentima, 3 – 05100 Terni</span><span style="font-size:8.0pt;font-family:TKTypeRegular;color:#1F497D">
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:francesco.vincenti@acciaiterni.it" target="_blank"><span style="font-size:8.0pt">francesco.vincenti@acciaiterni.it</span></a><span style="font-size:8.0pt;color:navy"><br>
</span><a href="http://www.aspasiel.it/" target="_blank"><span style="font-size:8.0pt">www.aspasiel.it</span></a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:8.0pt;color:#1F497D">Ufficio: </span><a href="tel:+39%200744%20203224" target="_blank"><span lang="EN-US" style="font-size:8.0pt">+39 0744
203224</span></a><span lang="EN-US" style="font-size:8.0pt;color:#1F497D"><br>
Fax: </span><a href="tel:+39%200744%20203444" target="_blank"><span lang="EN-US" style="font-size:8.0pt">+39 0744 203444</span></a><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto"><span lang="EN-US" style="font-size:10.0pt;font-family:TKTypeRegular">This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you
are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication
in error, please notify the error at the following email address: </span><a href="mailto:helpdesk@aspasiel.it" target="_blank"><span lang="EN-US" style="font-size:10.0pt;font-family:TKTypeRegular">helpdesk@aspasiel.it</span></a><span style="font-size:10.0pt;font-family:TKTypeRegular">
<span lang="EN-US">or at Aspasiel Helpdesk Team by phone (phone number </span></span><a href="tel:+39%200744%20203555" target="_blank"><span lang="EN-US" style="font-size:10.0pt;font-family:TKTypeRegular">+390744203555</span></a><span lang="EN-US" style="font-size:10.0pt;font-family:TKTypeRegular">),
and then delete this message from your system.</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:22.0pt;font-family:Webdings;color:green">P
</span><span lang="EN-GB" style="font-size:10.0pt;font-family:"Comic Sans MS";color:green">Please consider our environment and think before you print. Thank you!</span><span lang="EN-GB" style="color:blue">
</span><span lang="EN-GB" style="font-size:22.0pt;font-family:Webdings;color:green">q</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><br>
______________________________________________________________________________<br>
Member info: </span><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank"><span lang="EN-US">https://lists.balabit.hu/mailman/listinfo/syslog-ng</span></a><span lang="EN-US"><br>
Documentation: </span><a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank"><span lang="EN-US">http://www.balabit.com/support/documentation/?product=syslog-ng</span></a><span lang="EN-US"><br>
FAQ: </span><a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank"><span lang="EN-US">http://www.balabit.com/wiki/syslog-ng-faq</span></a><span lang="EN-US"><br>
<br>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><br>
<br clear="all">
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<meta name="Generator" content="Microsoft Word 15 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:TKTypeRegular;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0cm;
margin-right:0cm;
margin-bottom:10.0pt;
margin-left:0cm;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{margin-right:0cm;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
.MsoChpDefault
{font-family:"Calibri","sans-serif";}
.MsoPapDefault
{margin-bottom:10.0pt;
line-height:115%;}
@page WordSection1
{size:595.3pt 841.9pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0cm;margin-bottom:.0001pt;line-height:
normal">
<span lang="EN-US" style="font-size:10.0pt;font-family:"TKTypeRegular","serif"">This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent
responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the error at
the following email address: </span><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><a href="mailto:helpdesk@aspasiel.it"><span lang="EN-US" style="font-size:10.0pt;
font-family:"TKTypeRegular","serif"">helpdesk@aspasiel.it</span></a></span><span lang="EN-US" style="font-size:10.0pt;font-family:"TKTypeRegular","serif"">
or at Aspasiel Helpdesk Team by phone (phone number +390744203555), and then delete this message from your system.</span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:22.0pt;line-height:115%;
font-family:Webdings;color:green">P
</span><span lang="EN-GB" style="font-size:
10.0pt;line-height:115%;font-family:"Comic Sans MS";color:green">Please consider our environment and think before you print. Thank you!</span><span lang="EN-GB" style="font-size:12.0pt;line-height:115%;font-family:"Times New Roman","serif";
color:blue">
</span><span lang="EN-GB" style="font-size:22.0pt;line-height:115%;
font-family:Webdings;color:green">q</span></p>
</div>
</body>
</html>