Hi, On Wed, Mar 9, 2011 at 2:50 PM, Hidayath Basha <hidayath.basha@saventech.com> wrote:
Hi all,
I'm trying to transmit a huge log file (of about 80k lines) to a centralized syslog server over TCP
80k lines is piece of cake unless the average line length is quite big :)
But, on the syslog server, I'm receiver only the last part of the log file (of about 7000 lines)
How can I transmit the whole log file
syslog-ng keeps track where it left off reading a file to avoid sending the whole file again when it gets restarted so my guess is that you fired up syslog-ng a few times. To confirm this could you stop syslog-ng, delete /var/lib/syslog-ng.persist (or where your persist file lives) and start syslog-ng? If the problem persists then run syslog-ng under strace and show the relevant parts (file opens, seeks, reads). Regards, Sandor