<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">Hi Alex,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<br>
</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
After checking the stats, you have sent we can see that there had been some writes:</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
from</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<span style="margin:0px;font-family:monospace, serif, EmojiFont"><span style="margin:0px;background-color:rgb(255, 255, 255)">dst.program;d_localfile_linecard#0;/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10;a;</span><span style="margin:0px;font-weight:bold;color:rgb(255, 84, 84);background-color:rgb(255, 255, 255)">written</span><span style="margin:0px;background-color:rgb(255, 255, 255)">;4518</span><br>
</span></div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
to</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<pre>dst.program;d_localfile_linecard#0;/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10;a;written;4549
</pre>
<pre><ul><li><span style="margin:0px">we do not see increase in the counters of /var/log destinatons, but only on one destination</span></li><li><span style="margin:0px">we could <span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">only </span>see an increase in syslog-udp processed counters</span></li><li><span style="margin:0px">there are no dropped/queued counters</span></li></ul></pre>
<br>
</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<br>
</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<br>
</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
We would guess this could be due to flow-control, but for that we would need to see non-zero queued counter values, which is not the case. It could happen that one destination hangs/can't send messages out, which leads to suspended sources due to flow-control,
but the syslog() source is not affected since it doesn't send messages to the hanged destination(s).
<div style="margin:0px"><br>
</div>
<div style="margin:0px">Based on the stats, only "d_localfile_linecard" is active (~30 messages in 15 minutes), maybe the syslog() source would be affected too without the filtering.</div>
<div style="margin:0px"><br>
</div>
<div style="margin:0px"><br>
</div>
<div style="margin:0px"><br>
</div>
We should see more internal logs, which is problematic, since internal() source seems to be stopped too. For that I would recommend extracting internal() source from the s_src statement and putting it in a separate log path with a simple file destination.</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<span style="margin:0px">Also, if possible, could you please share your `write_with_rotation.sh` script? It is unlikely that it interferes with syslog-ng, but a double check would be nice. </span><span style="margin:0px">🙂</span><br>
</div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<span style="margin:0px"><br>
</span></div>
<div class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont">
<span style="margin:0px"><br>
</span></div>
<span class="x_elementToProof" style="margin:0px;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif, serif, EmojiFont"></span><br>
</div>
</body>
</html>