Hi, On Wed, Jul 2, 2008 at 5:13 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:
syslog-ng does not log message loss on file destinations, because that'd clutter the log statistics line, on the asssumption that no messages are can be lost there.
However this is not always the case, if you log_fifo_size() is smaller than the window size of incoming sources, messages can be lost.
Could something be added if -v were passed to syslog-ng then? It's (very) useful diagnostic information when you're tuning an installation and I probably wouldn't have noticed if not for the data that loggen outputs and the fact that the log file seemed small.
Here is a description of how flow-control and window sizes work in syslog-ng:
http://www.balabit.hu/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html
Please let me (and the doc team) know if the description could be made clearer somehow.
I hadn't seen this before -- I was only using the docs shipped with the tarball -- and it's good information. My setting of the log_fifo_size() in testing was for two reasons: (1) to see how setting it affected memory usage when being hit with many large messages and (2) to demonstrably see what its behavior was if it was overloaded and had to drop messages. I would have liked a little more info in the latter. As for the docs, it does mention that without the flow control messages may be lost, but doesn't indicate how this might be detected or what happens if they are. Thanks, Joe