Hi,
I have a "client" syslog-ng that reads from a unix domain socket and writes to a file destination as well as a tcp destination. I have a "server" syslog-ng listening on 0.0.0.0 on the port specified in the "client" tcp destination.
When I write a sample payload to the domain socket, syslog-ng writes the message in full to the file destination immediately. However I see no file created on the host referred to by tcp destination.
If I write a second payload, the first payload is now written to the remote location specified in the tcp destination.
It seems like syslog-ng is always one message behind in writing to the tcp destination.
I am able to flush the "client" syslog-ng buffer by sending a kill -1. This causes the payload to be written to the tcp destination.
Is this the only way to force syslog-ng to write all its buffer contents to the tcp destination? Or is there someway to control the flushing using flow-control?
"client" syslog-ng configuration:
@version: 3.0
options { flush_timeout(1000); };
source s_socks { unix-stream ("/home/srini/dev/log" max-connections(5) log_msg_size(3145728) flags(no-parse));
};
destination d_logs { file("/logs/app.log"); };
destination d_tcp { tcp("192.168.1.102" port(60999) frac_digits(6) keep-alive(yes) ); };
rewrite r_rewrite_newlines{ subst("#012", "\n", value("MESSAGE"), flags("global")); };
log { source(s_socks); rewrite(r_rewrite_newlines); destination(d_logs); };
log { source(s_socks); destination(d_tcp); };
"Server" syslog-ng: This is the "centralized" log server:
@version: 3.0
source s_tcp { tcp(port(60999)) log_msg_size(3145728) keep-alive(yes) };
destination d_logs { file("/logs/app.llog" };
rewrite r_rewrite_newlines{ subst("#012", "\n", value("MESSAGE"), flags("global")); };
log { source(s_tcp); rewrite(r_rewrite_newlines); destination(d_logs); };
Thanks. Srini