<div dir="auto">This means that we are indeed polling the journal ourselves and not rely on journald to forward the logs to us.<div dir="auto"><br></div><div dir="auto">If the error occurs, try to look at the syslog-ng statistic counters (syslog-ng-ctl stats) to see if your output queue is full. This could cause back pressure and reading to stop.</div><div dir="auto"><br></div><div dir="auto">Also, enabling debug/trace messages of syslog-ng could be helpful. You can also do that via syslog-ng-ctl, no restart is needed. The trace output should be excluded from your normal log processing pipeline, as it can be quite overwhelming in volume.</div><div dir="auto"><br></div><div dir="auto">I don't really have any other ideas at the moment. Still on vacation. :)</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 30, 2022, 19:43 Alexandre Santos <<a href="mailto:ASantos@infinera.com">ASantos@infinera.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="m_-7257105963668717508WordSection1">
<p class="MsoNormal">Hi Balazs,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks for the feedback!<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">It is definitely using journald, as you can see below.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When you say “Try to remove the syslog-ng persist file and check if reading the journal restarts.”, this is to do when the system in the error condition, right?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards,<u></u><u></u></p>
<p class="MsoNormal">Alex<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">source s_src {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">#Start Block source generator system<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">channel {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> source {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">systemd-journal();<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> }; # source<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">channel {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> channel {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> parser {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">#Start Block parser generator app-parser<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">channel {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> junction {<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">channel { filter { tags('.app.doesnotexist'); }; flags(final); }; };<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">}<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">#End Block parser generator app-parser<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">;<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> };<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> flags(final);<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> };<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> channel { flags(final); };<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">};<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">}; # channel<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"><u></u> <u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">#End Block source generator system<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">;<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> internal();<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas"> syslog(ip(19.88.4.17) transport("udp") port(514) keep-alive(no));<u></u><u></u></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas">};<u></u><u></u></span></b></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng-bounces@lists.balabit.hu</a>> <b>
On Behalf Of </b>Balazs Scheidler<br>
<b>Sent:</b> 26 de junho de 2022 06:37<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Local sources seem not to be working<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I haven't seen anything like this. We are reading the journal files using libsystemd.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Try to remove the syslog-ng persist file and check if reading the journal restarts.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Also there's can be two ways of local messages getting to syslog-ng,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">1) /dev/log forwarding<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2) reading the journal files<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The first one is actively done by journald. Which one syslog-ng uses is automatically detected by our system() source.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">To see which one syslog-ng is trying to use, try to run it with --preprocess-into=some-file and check how system() source is expanded.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I am unable to check the source code at the moment, so this is all from the top-of-my-head, but I hope this already helps to troubleshoot the issue.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jun 24, 2022, 18:21 Alexandre Santos <<a href="mailto:ASantos@infinera.com" target="_blank" rel="noreferrer">ASantos@infinera.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">Hi<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Any news regarding this issue?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Making a recap of the findings:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<ul type="disc">
<li class="m_-7257105963668717508m-8312131628699672886msolistparagraph">
Using a Debian 10 buster with first release with 3.36.1;<u></u><u></u></li></ul>
<ul type="disc">
<li class="m_-7257105963668717508m-8312131628699672886msolistparagraph">
After some time “system()” source logs are not getting written to the destinations;<u></u><u></u></li><li class="m_-7257105963668717508m-8312131628699672886msolistparagraph">
The log messages from other sources, internal() and syslog(…) continue to work fine, being written to the destinations;<u></u><u></u></li><li class="m_-7257105963668717508m-8312131628699672886msolistparagraph">
One the things I noticed is that the socket to the journal seems to vanish during the error situation:<u></u><u></u></li></ul>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">It seems that somehow syslog-ng in unable to read from linux journal.<u></u><u></u></p>
<p class="MsoNormal"><b>Have you ever experienced this problem?</b><u></u><u></u></p>
<p class="MsoNormal"><b>Do know what can be wrong with the system?</b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">root@machine:~# lsof /run/log/journal/98101a328524447d88917bea845a8966/system*</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root mem REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root mem REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root 16u REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root 24u REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">syslog-ng 3201 root mem REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">syslog-ng 3201 root mem REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">syslog-ng 3201 root 14r REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">syslog-ng 3201 root 15r REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root mem REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root mem REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root 5r REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root 6r REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">root@ machine:~# lsof /run/log/journal/98101a328524447d88917bea845a8966/system*</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root mem REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root mem REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root 16u REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">systemd-j 1723 root 24u REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root mem REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root mem REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root 5r REG 0,19 8388608 31745 /run/log/journal/98101a328524447d88917bea845a8966/system.journal</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">journalct 6861 root 6r REG 0,19 8388608 26165
<a href="mailto:/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal" target="_blank" rel="noreferrer">
/run/log/journal/98101a328524447d88917bea845a8966/system@3721b31246e54dc0baab1ac0f68c3f43-0000000000000001-000581d7e3fe20ba.journal</a></span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thanks in advance,<u></u><u></u></p>
<p class="MsoNormal">Alex<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Alexandre Santos<br>
<b>Sent:</b> 19 de maio de 2022 09:25<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Local sources seem not to be working<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Hi Szilard,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">There is no filter:<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">source syslog_ng_src {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> internal();</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">};</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">destination d_localfile_syslog_ng {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> program("/opt/machine/local/bin/write_with_rotation.sh /var/log/syslog-ng-internal.log 10 10"</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> flags(syslog-protocol)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> suppress(5)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> disk-buffer(</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> mem-buf-size(2097152)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> disk-buf-size(4194304)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> reliable(yes)</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> dir("/tmp")</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> )</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> );</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">};</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">log {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> source(syslog_ng_src);</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> destination(d_localfile_syslog_ng);</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> flags(flow-control);</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">};</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal">Thanks and Regards,<u></u><u></u></p>
<p class="MsoNormal">Alex<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Szilard Parrag (sparrag)<br>
<b>Sent:</b> 19 de maio de 2022 08:59<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> Re: [syslog-ng] Local sources seem not to be working<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div style="border:solid #9c6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#ffeb9c">
<b><span style="font-size:10.0pt;color:#9c6500">CAUTION:</span></b><span style="font-size:10.0pt;color:black"> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content
is safe.</span><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi Alex,</span><u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control
<span style="background:white">enabled</span>.</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><u></u><u></u></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it?</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Szilard</span><u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=05%7C01%7Casantos%40infinera.com%7C103d70dac2394363b6f808da5735e22c%7C285643de5f5b4b03a1530ae2dc8aaf77%7C1%7C1%7C637918186202981595%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=WNrM7LVg0OQZ4H%2FdhbZd4mCQ%2F6dAUsu9gJlgEa2aoCk%3D&reserved=0" target="_blank" rel="noreferrer">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=05%7C01%7Casantos%40infinera.com%7C103d70dac2394363b6f808da5735e22c%7C285643de5f5b4b03a1530ae2dc8aaf77%7C1%7C1%7C637918186202981595%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=O5s9C1DJkKe%2F%2FJRWzDpRO4tpU1I31b%2F%2BG1SBXmG26Ps%3D&reserved=0" target="_blank" rel="noreferrer">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=05%7C01%7Casantos%40infinera.com%7C103d70dac2394363b6f808da5735e22c%7C285643de5f5b4b03a1530ae2dc8aaf77%7C1%7C1%7C637918186202981595%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=CiurkG9FrrVfxETCA8L5nVWoHofbzNrwn%2BP%2BpfAHX1k%3D&reserved=0" target="_blank" rel="noreferrer">
http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>