When I send a batch of 100k log messages to the first machine, they all end up in its file, but about 25% of them never make it through to the second machine's log.
Any ideas?
Probably the speed of your network is less than required. How fast are you sending those messages? syslog-ng can do with quite high loads (2G logs a day), but it still cannot widen your network bandwidth. Note that log connections in syslog-ng (e.g. a log statement) is not flowcontrolled. This means that messages are continously read even if they have not yet been flushed to the destination. The reason behind this is to prevent syslog-ng to become the bottleneck.
btw: to allow bursts set the log_fifo_size option of destination files to a higher value (100 by default) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt