Flush-lines controls the maximum buffer size, but syslog-ng will automatically flush if there's no input. So you will see one message at a time unless messages are streaming in at a high pace.

Flush-lines used to work differently, but was changed when syslog-ng became multithreaded.

On Oct 15, 2015 6:31 AM, "伊藤宏平" <ki0412@hotmail.com> wrote:

Thank you for your advice.
I tried you options.
But the problem is same.

I use options below.
options {
chain_hostnames(off);
flush_lines(3);
flush_timeout(5);
use_dns(no);
use_fqdn(no);
owner("root");
group("adm");
perm(0640);
stats_freq(600);
bad_hostname("^gconfd$");
};

I try to catch log by tail command.
like this "$sudo tail -f /var/log/messages"

I expected to 3 line show at a time.
But log shows one by one, when I call logger command.

Could you confirm that the log shows at once? Or one by one?

thanks!
To: syslog-ng@lists.balabit.hu
From: erempel@uvic.ca
Date: Wed, 14 Oct 2015 20:01:54 -0700
Subject: Re: [syslog-ng] Is the option flush_lines valid now?

What happens when you try to use the option.

I use it with syslog-ng 3.7.1

options {
        log_fifo_size(20000000);
        use_fqdn(yes);
        keep_hostname(yes);
        chain_hostnames(yes);
        time_reap(60);
        time_reopen(5);
        flush_lines(15000);
        flush_timeout(2000);
        stats_level(1);
        log_msg_size(16384);
};

without any problems.

On 10/14/2015 04:35 PM, 伊藤宏平 wrote:
I tried to use syslog-ng.

At first I used a syslog-ng 3.5.3 on ubuntu14.04.

But I can not use flush_line option.

I asked question in stack overflow.

Mr.argus said that " There is a lack of condition"

linux - syslog-ng の flush_lines　オプションが効かない - スタック・オーバーフロー

Specifically function "log_writer_flush" should be like that.

Before:
gboolean
log_writer_flush(LogWriter *self, LogWriterFlushMode flush_mode)
{
                       :

  if (flush_mode >= LW_FLUSH_BUFFER || count == 0)
  {
    if (log_proto_client_flush(proto) == LPS_ER!
 ROR
)
      return FALSE;
  }
After:
LogProtoFileWriter *w = (LogProtoFileWriter *)proto;
if ( (w->buf_count >= w->buf_size) && (flush_mode >= LW_FLUSH_BUFFER || count == 0) )
  {
    if (log_proto_client_flush(proto) == LPS_ER!
 ROR
)
      return FALSE;
  }
And now I use a latest syslog-ng ose 3.7.1, hoping the bug has been fixed.

But I can not use flush_line option either.

Is the option flush_lines valid now?
try (動) 試みる、努める、努力する、試す、挑む、見る、審理する

tried (形) 検査済みの、証明済みの、試験済みの

Powered by iKnow!
This body part will be downloaded on demand.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
advice (名) 助言、アドバイス、勧め

Powered by iKnow!
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq