We've mostly resolved the issue (combination of flow control and feeding syslog-ng from the journald file. Disabling flow control and rate limiting and setting forward to syslog true almost cures things.

However, there's a serious bug in journald which will cause some number of logs to disappear without any report of missed forwarding of logs. I've raised an issue on the github master for systemd

https://github.com/systemd/systemd/issues/13078:

Possible bug in journald-syslog.c #13078

I fear that this oversight in systemd/journald is not the only occurrence of this bug, just the one we're seeing.

On 7/10/19 10:53 AM, Fabien Wernli wrote:
Hi,

On Fri, Jul 05, 2019 at 03:00:48PM +0000, Evan Rempel wrote:

I noticed that between 3.9 and 3.14 this issue was introduced. Buffering to any destination seems to block all destinations of he message.

This seems pretty bad to me.
Could you open an issue on github for this please?

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq