<div dir="ltr">Hello Laszlo, what role/s can NFS play on data that was received on the interface but couldn't be written, for example, this case mentioned here?<div><br></div><div>Hello Harish, is your traffic UDP/TCP and the host in this a virtual machine? Have you tried any tuning so far?</div><div><br></div><div>Thank you.</div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Sep 20, 2018 at 3:57 AM Budai, László <<a href="mailto:laszlo.budai@oneidentity.com">laszlo.budai@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi,</div><div><br></div><div>there can be many reasons... (are you using network filesystem?) <br></div><div><br></div><div>Base on your other question you have a filter. Could you share your configuration?</div><div><br></div><div>syslog-ng provides statistics on filters (match/unmatch), but only from stats-level-2 (and as I remember from version 3.10), example cfg:</div><div>@version: 3.17 <br><br>@include "scl.conf"<br><br>options {<br> stats-level(2);<br>};<br><br>source s_net {<br> network(<br> port(5555)<br> transport("tcp")<br> );<br>};<br><br>destination d_net {<br> network(<br> "localhost" port(15554)<br> transport(tcp)<br> );<br>};<br><br>filter f_test {<br> match("TEST" value(MESSAGE))<br>};<br><br>log {<br> source(s_net);<br> filter(f_test);<br> destination(d_net);<br> flags(flow-control);<br>};<br><br></div><div><br></div><div>and then:</div><div><br></div><div><div>sbin/syslog-ng-ctl query get 'filter.f_test.*'<br></div><br></div><div><br></div><div>L.<br></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 20, 2018 at 12:31 PM, Harish Shetty <span dir="ltr"><<a href="mailto:harish23shetty@gmail.com" target="_blank">harish23shetty@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi All</div><div><br></div><div>I have syslog-ng (syslog-ng-3.9.1-1.el6.x86_64) which is running on Red Hat 6.6. I have rule defined as mentioned below</div><div><br></div><div>destination d_networkx { file("/mnt/u001/syslog/$HOST/$YEAR$MONTH$DAY/network.log"); };</div><div><br></div><div>But syslog-ng is unable to write some logs to local file even though we see those logs in the tcpdump? What could be causing this.</div><div><br></div><div>And one more thing need to know , is ther any way to check per filter (d_networkx) how many we received and how many we Processed(wrote) to a file</div><div><br></div><div>Regards</div><span class="m_-5350543250360021154HOEnZb"><font color="#888888"><div>Harish Shetty<br></div><div><br></div><div><br></div></font></span></div></div></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Thanks,<div>Vijay Amrut.</div></div></div></div>