<div dir="ltr">Thanks for your guidance, I'm using syslog-ng docker file, should I test with bare syslog-ng without docker before filling an issue?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 7, 2020 at 10:45 PM Balazs Scheidler <<a href="mailto:bazsi77@gmail.com">bazsi77@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">If you think that's the case, please submit a bug report with details why you think it is behaving incorrectly.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 7, 2020, 19:51 Ali Shirvani <<a href="mailto:aj.shirvani@gmail.com" target="_blank">aj.shirvani@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Thanks for your reply, I has been checked the syslog-ng debug console, it detected the broken connection, and queue further messages<div>and send them when the link is available. But I think it doesn't detect link down properly.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 7, 2020 at 10:15 PM Balazs Scheidler <<a href="mailto:bazsi77@gmail.com" rel="noreferrer" target="_blank">bazsi77@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">The tcp stack of the host would return success for the first message that follows a tcp connection termination.<div dir="auto"><br></div><div dir="auto">We have no way of knowing that it was actually sent or not, the host kernel doesn't return this information.</div><div dir="auto"><br></div><div dir="auto">Syslog-ng tries to detect connection termination proactively and as long as we don't have a message to write we should detect the closing connection and avoid the loss of the upcoming message. Please check if syslog-ng detects the closing connection, it should report this in its debug log level, look for something like "eof detected on an idle connection".</div><div dir="auto"><br></div><div dir="auto">The complete solution to this is application level acknowledgement, which is an extra protocol layer over tcp.</div><div dir="auto"><br></div><div dir="auto">Syslog-ng PE has rltp for this purpose but that's a proprietary feature and I found its extra overhead is rarely needed.</div><div dir="auto"><br></div><div dir="auto">Bazsi</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 7, 2020, 19:03 Ali Shirvani <<a href="mailto:aj.shirvani@gmail.com" rel="noreferrer" target="_blank">aj.shirvani@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi all,<div><br></div><div>I tried to setup simple relay with syslog-ng, it receives log on one port and forward to the destination. It works fine when destination is available, but when destination unavailable for a short period of time and then became available I miss one log entry.</div><div><br></div><div>For example assume that I send simple numbers with logger command to syslog-ng, from 0 to 100, when I receive 50 on destination I stop its listener and start it again, in this case the first log entry that I receive is 52 instead of 51.</div><div><br></div><div>Here is my syslog-ng.conf:</div><div><br></div><div>@version: 3.26<br></div><div><br>options {<br> time_reopen(5);<br>};<br><br>source s_network {<br> network(<br> ip("127.0.0.1")<br> port(514)<br> transport("udp")<br> );<br>};<br><br>destination d_network {<br> network(<br> "127.0.0.1"<br> port(5514)<br> transport("udp")</div><div> );<br>};<br></div><div><br></div><div>log {<br> source(s_network);<br> destination(d_network);<br>};<br></div><div><br></div><div>Would you please help me to resolve this issue?</div><div><br></div><div>Regards,</div><div>Ali</div></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>