Both TCP and UDP use the same code to send messages in 1.5.x and as it seems syslog-ng piggybacks messages together when writing messages. This is correct for TCP but incorrect for UDP.
Yes.
The culprit is libol/src/pkt_buffer.c which uses stream based buffering in the 0.3 branch while it used a packet based one in 0.2
I see.
As there are more than one message in a single UDP packet the packet can grow bigger than your MTU, thus packet fragmentation is done.
Exactly, although this should influence the loss too much, IMHO.
Both can increase message loss (more than one message in a single packet, fragmentation) thus this is definitely a bug. I'll look into fixing this.
Thanks.
Another question: Why is there no message sent when a buffer reaches its maximum size? This would help debugging and tuning a lot IMHO. Sorry if this has been discussed before.
Because this message itself would fill your buffers. Instead syslog-ng
Doh (slaps forehead), Of course.
reports the number of dropped messages in a separate message sent once every ten minutes (default).
Call me stupid but (assuming you mean the STATS part): ratz@zar:~/down/log > find . -name "*.[ch]" -exec grep -n dropped_pkts /dev/null {} \; ./libol-0.3.8/src/pkt_buffer.h:30:int pktbuf_dropped_pkts; ./syslog-ng-1.5.25/src/main.c:138: notice("STATS: dropped %i\n", pktbuf_dropped_pkts); ./syslog-ng-1.5.25/src/main.c:139: pktbuf_dropped_pkts = 0; ratz@zar:~/down/log > What else then 0 should this code print? At least I've found the hardcoded timeout in libol/src/io.c. :) Thanks for your time, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc