On Wed, 2008-03-12 at 09:36 -0700, Evan Rempel wrote:
Balazs Scheidler wrote:
On Wed, 2008-03-05 at 11:50 -0800, Evan Rempel wrote:
Please bear with me. This is a little involved.
I know about one possible bug that might explain this: as long as the _first_ connection to a TCP destination is not established, dropped messages are not counted.
E.g. the dropped counter is allocated for a destination when the first connection is established.
So if server2 was down when syslog-ng started and server1 was up, syslog-ng might not count dropped messages towards server2 in the initial period.
Does that sound possible?
It does sound possible, but I can't really confirm this. We have 17 sysadmin making changes to 25 different network segments, firewall etc, and on top of that we just moved one of our two syslog servers to a different new data center with all of the accompanying firewall issues that go with 30 new subnets being rolled out at once :-(
All I really wonder now is "in what version of syslog-ng has/was this issue addressed?"
It was not fixed yet, my collegue diagnosed it in the previous weeks, but I did not get around to fix that yet. -- Bazsi