Apologies for my broken email client, which shall remain nameless!
# default contrib'd version # source s_sys { pipe("/dev/log"); internal(); };
# recommended by INSTALL source s_sys { pipe("/dev/log" pad_size(2048)); };
This should be the proper source statement. I've just retested it on our local HP-UX box and it seems to work fine.
The things you are experiencing seems to indicate that the pad_size() option is missing, therefore I'd like to ask if you are certain that syslog-ng is running with the pad_size() configuration.
Yep, it definitely appears to be opening the configuration file that I'm playing with: # nohup /opt/tusc/bin/truss -o /tmp/syslog-ng.truss -aef /usr/local/sbin/syslog-ng --debug --foreground --stderr > syslog-ng.out 2>&1 & # grep syslog-ng.conf /tmp/syslog-ng.truss 7197: open("/usr/local/etc/syslog-ng.conf", O_RDONLY|O_LARGEFILE, 0666) = 4 #
If you still think it is, you might want to use tusc to check if syslog-ng reads /dev/log in 2048 byte chunks (which is should if pad_size() is enabled and which it doesn't if it is not).
Most of the time it does, but sometimes it doesn't: 7197: read(4, "< 3 8 > S e p 7 1 0 : 5 2 ".., 8192) = 2048 7197: read(4, 0x40025dbd, 8187) ERR#11 EAGAIN 7197: read(4, "< 2 8 > S e p 7 1 0 : 5 3 ".., 8187) = 2048 7197: read(4, "< 2 7 > S e p 7 1 0 : 5 3 ".., 8187) = 4096 7197: read(4, 0x40025db8, 8192) ERR#11 EAGAIN 7197: read(4, "< 2 2 > S e p 7 1 0 : 5 4 ".., 8192) = 4096 7197: read(4, "< 2 2 > S e p 7 1 0 : 5 4 ".., 8187) = 2048 7197: read(4, 0x40025dbd, 8187) ERR#11 EAGAIN 7197: read(4, "< 2 2 > S e p 7 1 0 : 5 4 ".., 8187) = 2048 7197: read(4, 0x40025dbd, 8187) ERR#11 EAGAIN 7197: read(4, "< 3 8 > S e p 7 1 0 : 5 5 ".., 8187) = 8187 7197: read(4, "\0\0\0\0\0< 3 8 > S e p 7 ".., 8192) = 6149 7197: read(4, "< 2 2 > S e p 7 1 0 : 5 5 ".., 8187) = 8187 7197: read(4, "u s . n e ", 8173) = 5 7197: read(4, "< 2 8 > S e p 7 1 0 : 5 5 ".., 8168) = 2048 7197: read(4, "< 2 7 > S e p 7 1 0 : 5 5 ".., 8187) = 4096 7197: read(4, 0x40025db8, 8192) ERR#11 EAGAIN 7197: read(4, "< 2 8 > S e p 7 1 0 : 5 7 ".., 8192) = 2048 7197: read(4, "< 2 7 > S e p 7 1 0 : 5 7 ".., 8187) = 4096 7197: read(4, 0x40025db8, 8192) ERR#11 EAGAIN 7197: read(4, "< 2 8 > S e p 7 1 0 : 5 9 ".., 8192) = 2048 7197: read(4, "< 2 7 > S e p 7 1 0 : 5 9 ".., 8187) = 4096 7197: read(4, 0x40025db8, 8192) ERR#11 EAGAIN 7197: read(4, "< 3 8 > S e p 7 1 1 : 0 0 ".., 8192) = 2048 7197: read(4, "< 3 8 > S e p 7 1 1 : 0 0 ".., 8192) = 8192 7197: read(4, "< 3 8 > S e p 7 1 1 : 0 0 ".., 8192) = 8192 7197: read(4, "< 3 8 > S e p 7 1 1 : 0 0 ".., 8192) = 8192 7197: read(4, "< 2 2 > S e p 7 1 1 : 0 0 ".., 8192) = 8192 7197: read(4, "< 2 2 > S e p 7 1 1 : 0 0 ".., 8187) = 8187 7197: read(4, "\0\0\0\0\0", 8192) = 5 7197: read(4, "< 2 8 > S e p 7 1 1 : 0 1 ".., 8192) = 2048 7197: read(4, "< 2 7 > S e p 7 1 1 : 0 1 ".., 8187) = 4096 7197: read(4, 0x40025db8, 8192) ERR#11 EAGAIN Regards, Scott