On Mon, 2007-12-17 at 10:15 +0000, AndyH@nominet.org.uk wrote:
Hi,
I'm running the latest version compiled on Solaris 10
It runs ok for a while but then I get this:
syslog-ng[18894]: Insufficient buffer space for retrieving STREAMS log message; res='2'
and then nothing new logs apart from the "-- MARK --" lines
I've seen a couple of references to this problem here
https://lists.balabit.hu/pipermail/syslog-ng/2007-September/010690.html
but the patches mentioned are all now in the downloaded src.
Is there any other reason for this behaviour?
Hmm... can you check if specifying fetch_limit(1) fixes this problem? Or better yet, can you check if this patch solves it: diff --git a/src/afstreams.c b/src/afstreams.c index 981b88e..009b074 100644 --- a/src/afstreams.c +++ b/src/afstreams.c @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist) close(fd); return FALSE; } - self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); + self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options); log_pipe_append(self->reader, s); if (self->door_filename) If this still does not help, then your kernel log might be longer than the maximum specified by log_msg_size(), try to increase that number. -- Bazsi