Hello,
As there are some changes since syslog-ng 1.6.5, I'd like to release a new version. Before doing so I'd like to ask you to test the latest snapshot a little bit.
Ok, while browsing through our internal bugzilla DB I've found another bug which is still reproduceable with the latest drop of your sources. The problem is that with a TCP reset from the receiving end of syslog-ng messages we lose one message line while syslog-ng tries to reconnect. Here is a brief instruction on how to reproduce this use case: o You need two nodes, A and B (TARGET_IP). o On node A add the following lines to syslog-ng.conf for the use case options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_int { internal(); unix-stream("/dev/log" max-connections(256)); udp(ip(127.0.0.1) port(514)); file("/proc/kmsg"); }; filter f_test { facility(news) and level(emerg); }; destination d_net { tcp("<TARGET_IP>" port(1513) template("$DATE testpf $MSG\n")); }; log { source(s_int); filter(f_test); destination(d_net); flags(final); } o fire up syslog-ng with this configuration o on node B (TARGET_IP) run the following: netcat -l -p 1513 o on node A type the following logger -p news.emerg "test message1" logger -p news.emerg "test message2" logger -p news.emerg "test message3" logger -p news.emerg "test message4" you should see the messages coming on TARGET_IP: o now stop the netcat (CTRL-C): foo@bar:~ > netcat -l -p 1513 Feb 2 10:44:25 testpf root: test message1 Feb 2 10:44:26 testpf root: test message2 Feb 2 10:44:28 testpf root: test message3 Feb 2 10:44:30 testpf root: test message4 punt! o and generate some more messages on node A: logger -p news.emerg "test message5" logger -p news.emerg "test message6" logger -p news.emerg "test message7" logger -p news.emerg "test message8" o and afterwards restart the netcat on TARGET_IP foo@bar:~ > netcat -l -p 1513 Feb 2 10:44:39 testpf root: test message6 Feb 2 10:44:41 testpf root: test message7 Feb 2 10:44:49 testpf root: test message8 All the queued messages appear except number 5 which has been eaten by some evil bug. I suspect an off-by-one error somewhere but in my life I've already suspected a lot of things ;). I'd be grateful to help debugging this case. Cheers, Roberto Nibali, ratz -- ------------------------------------------------------------- addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 ------------------------------------------------------------- terreActive AG Wir sichern Ihren Erfolg -------------------------------------------------------------