Balazs Scheidler (bazsi@balabit.hu) wrote on 2 July 2008 11:13:
syslog-ng does not log message loss on file destinations, because that'd clutter the log statistics line, on the asssumption that no messages are can be lost there.
However this is not always the case, if you log_fifo_size() is smaller than the window size of incoming sources, messages can be lost.
Here is a description of how flow-control and window sizes work in syslog-ng:
http://www.balabit.hu/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html
Please let me (and the doc team) know if the description could be made clearer somehow.
I found this part confusing: The syslog-ng application monitors (polls) the sources defined in its configuration file, periodically checking each source for messages. When a log message is found in one of the sources, syslog-ng polls every source and reads the available messages. This means it breaks the periodicity of the checks, because when it finds something in one source it checks the others immediately. Is this true? If it is it doesn't look very useful because each source should be polled frequently enough independently of the others.