Hi,

I have a "client" syslog-ng that reads from a unix domain socket and writes to a file destination as well as a tcp destination. I have a "server" syslog-ng listening on 0.0.0.0 on the port specified in the "client" tcp destination.

When I write a sample payload to the domain socket, syslog-ng writes the message in full to the file destination immediately. However I see no file created on the host referred to by tcp destination.

If I write a second payload, the first payload is now written to the remote location specified in the tcp destination.

It seems like syslog-ng is always one message behind in writing to the tcp destination.

I am able to flush the "client" syslog-ng buffer by sending a kill -1. This causes the payload to be written to the tcp destination.

Is this the only way to force syslog-ng to write all its buffer contents to the tcp destination? Or is there someway to control the flushing using flow-control?


"client" syslog-ng configuration:

@version: 3.0

options {
        flush_timeout(1000);
};

source s_socks {
        unix-stream ("/home/srini/dev/log"
        max-connections(5)
        log_msg_size(3145728)
        flags(no-parse));
       
};

destination d_logs {
        file("/logs/app.log");
};

destination d_tcp {
        tcp("192.168.1.102" port(60999)
        frac_digits(6)
        keep-alive(yes)
        );
};

rewrite r_rewrite_newlines{
        subst("#012", "\n", value("MESSAGE"), flags("global"));
};

log {
        source(s_socks);
        rewrite(r_rewrite_newlines);
        destination(d_logs);
};

log {
        source(s_socks);
        destination(d_tcp);
};


"Server" syslog-ng: This is the "centralized" log server:

@version: 3.0

source s_tcp {
    tcp(port(60999))
    log_msg_size(3145728)
    keep-alive(yes)
};


destination d_logs {
    file("/logs/app.llog"
};

rewrite r_rewrite_newlines{
        subst("#012", "\n", value("MESSAGE"), flags("global"));
};

log {
    source(s_tcp);
    rewrite(r_rewrite_newlines);
    destination(d_logs);
};


Thanks.
Srini