Am 12.01.2012 02:05, schrieb Clayton Dukes:
I have a user experiencing an issue where some of the incoming logs are not getting piped to my perl script until the second time we generate events.
I believe this is generally set using flush_lines(1), but it doesn’t seem to be honoring that setting in the config. I also tried adding flush_timeout(900), but that has no affect. In the output below, if I quit the telnet and start it again, the previously missing events are then received (but the current ones are missing) - basically, it doesn't appear to be flushing every single line. Possible other reason: has something changed between v2.x and 3.x where the program() destination would possibly not send an EOF signal - i.e. is the pipe now kept open vs. an individual call to the program each time in v2.x?
Posting your syslog-ng.conf could help. Peter