Great explanation! I guess I forgot that a pipe is not a file. I thought it would just store the logs until the reader woke up again. Is the pipe is limited by system resources or something else? This explains the dropped stat messages but the fifo is only one destination. Why doesn't syslog-ng drop the messages destined for destination(pipe /foo/fifo/} and continue to send messages to all the other destinations successfully? I have evidence to support that some messages to all destinations are dropped. Why? Thanks again Valdis for your most elementary clarification of FIFO-syslog-ng interaction. :) Alex -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks@vt.edu Sent: Thursday, July 20, 2006 9:28 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng to Pipe question
My question to the experts of the list is why would syslog-ng start dropping messages after a separate program reading syslog-ng's destination fifo dies? Is it just coincidence that my monitoring program died at exactly the hour I started getting dropped stats?
<mode silly> Imagine a cardboard tube, several feet long and several inches in diameter. We give one guy a *big* basket of balls, and he starts putting the balls into one end of the tube, one by one. Meanwhile, we have another guy at the other end, taking balls out one at a time. Now this second guy decides it's time for a nap, so he stops taking balls out and tapes something across the end of the tube so balls won't fall out accidentally. Eventually, the tube gets full, and when the guy with the basket tries to put another ball in, it doesn't fit, and just gets dropped on the floor. </mode> In other words, there's a limit to how much buffering a pipe with no reader will give you before it starts complaining, and yes, it's no coincidence that it started dropping messages when the program reading the pipe went away. After all, what *else* was it supposed to do with them at that point? ;) This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.