Hi,
there can be many reasons... (are you using network filesystem?)
Base on your other question you have a filter. Could you share your configuration?
syslog-ng provides statistics on filters (match/unmatch), but only from stats-level-2 (and as I remember from version 3.10), example cfg:
@version: 3.17
@include "scl.conf"
options {
stats-level(2);
};
source s_net {
network(
port(5555)
transport("tcp")
);
};
destination d_net {
network(
"localhost" port(15554)
transport(tcp)
);
};
filter f_test {
match("TEST" value(MESSAGE))
};
log {
source(s_net);
filter(f_test);
destination(d_net);
flags(flow-control);
};
and then:
sbin/syslog-ng-ctl query get 'filter.f_test.*'
L.