<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Alex,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Your second log path (where the remote destination configured) applies flow-control:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> log {<br>
</span>
<div> source(s_src);<br>
</div>
<div> rewrite(r_host);<br>
</div>
<div> filter(f_remote_test_udp);<br>
</div>
<div> destination(d_test_udp);<br>
</div>
<div><b> flags(flow-control);</b><br>
</div>
<span> };</span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Since your remote destination is not available, when all the related buffers got filled the
<b>s_src</b> source will be suspended. When a source is in a suspended state, Syslog-ng will not read logs from it. <span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 12pt;">There is no problem with your local file, simply
there is "no new logs" to write.</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Laci</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Alexandre Santos <alexandre.rosas.santos@gmail.com><br>
<b>Sent:</b> Wednesday, July 29, 2020 10:51<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] File destination is not being written, when it can not bind remote host address</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div class="x_gmail_quote">
<div dir="ltr">
<div>Hi,</div>
<div><br>
</div>
<div>I do not know if this a seen issue or not. I am using syslog-ng version 3.19 on a Debian 10.<br>
</div>
<div>I have the configuration which is attached in this email: syslog-ng.conf, that has one local file destination and one remote host destination.</div>
<div><br>
</div>
<div>1. Start the syslog-ng<br>
</div>
<div>The localip of syslog destination is not available and therefore I have these errors, as expected:</div>
<div><span style="font-family:monospace">syslog-ng[1482]: [2020-07-27T12:58:00.069422] Error binding socket; addr='AF_INET(10.0.2.6:0)', error='Cannot assign requested address (99)'<br>
syslog-ng[1482]: [2020-07-27T12:58:00.069439] Initiating connection failed, reconnecting; time_reopen='60'
<br>
</span></div>
<div><span style="font-family:monospace"><br>
</span></div>
<div><span style="font-family:monospace"><font face="arial,sans-serif">2. After some time running syslog-ng stops sending the logs to the local file. Why?<br>
</font></span></div>
<div><span style="font-family:monospace"><font face="arial,sans-serif"><br>
</font></span></div>
<div><span style="font-family:monospace"><font face="arial,sans-serif">3. If I reload the syslog-ng configuration, without the remote destination, the old logs are immediately flushed to the local file.</font></span></div>
<div><span style="font-family:monospace">Jul 27 <b>15:05:55</b> localhost syslog-ng[29680]: [<b>2020-07-27T15:05:55.378</b>019] Incoming log entry from journal; message='[<b>2020-07-27T13:44:06.890</b>952] Outgoing message; message=\'<30>1 2020-07-27T13:44:06.772+00:00
localhost syslog-ng 29680 - - [2020-07-27T13:44:06.772722] Processing the time zone file (32bit part); filename=\\'/usr/share/zoneinfo/UTC\\'\x0a\''<br>
Jul 27 15:05:55 localhost syslog-ng[29680]: [2020-07-27T15:05:55.378032] json-parser(): no marker at the beginning of the message, skipping JSON parsing ; input='[2020-07-27T13:44:06.890952] Outgoing message; message=\'<30>1 2020-07-27T13:44:06.772+00:00 localhost
syslog-ng 29680 - - [2020-07-27T13:44:06.772722] Processing the time zone file (32bit part); filename=\\'/usr/share/zoneinfo/UTC\\'\x0a\'', marker='@cim:'</span></div>
<div><br>
</div>
<div>Is this a new issue?</div>
<div>Is there any configuration to prevent this?<br>
</div>
<div><br>
</div>
<div>In attachment also the journalctl of syslog-ng in debug mode (syslog-ng -Fvde).<br>
</div>
<div></div>
<div><br>
</div>
<div>Thanks and regards,</div>
<div>Alex<br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>