My question to the experts of the list is why would syslog-ng start dropping messages after a separate program reading syslog-ng's destination fifo dies? Is it just coincidence that my monitoring program died at exactly the hour I started getting dropped stats?
<mode silly> Imagine a cardboard tube, several feet long and several inches in diameter. We give one guy a *big* basket of balls, and he starts putting the balls into one end of the tube, one by one. Meanwhile, we have another guy at the other end, taking balls out one at a time. Now this second guy decides it's time for a nap, so he stops taking balls out and tapes something across the end of the tube so balls won't fall out accidentally. Eventually, the tube gets full, and when the guy with the basket tries to put another ball in, it doesn't fit, and just gets dropped on the floor. </mode> In other words, there's a limit to how much buffering a pipe with no reader will give you before it starts complaining, and yes, it's no coincidence that it started dropping messages when the program reading the pipe went away. After all, what *else* was it supposed to do with them at that point? ;)