On Thu, 4 Jan 2001, Jon Marks wrote:
Hello,
I'm testing syslog-ng with TCP transport, and I'm a little surprised- perhaps I'm doing something wrong? I'm finding severe message loss, which I had imagined TCP would eliminate.
I've reported the same thing on this list in the past. Indeed, my machines can even lose messages when the input is a pipe and the output is a local file! The culprit is this bit of code at line 71 in libol: if (self->queue_size == self->queue_max) { /* fifo full */ ol_string_free(string); return ST_FAIL | ST_OK; } If the queue is full, your message is dismissed and cannot be recovered. If you put a printf() statement in that code block, I bet you will see that you are hitting this misfeature. I tried fixing this problem, but there is not a simple way. It requires significant changes to syslog-ng's message handling loop. -jwb