Evan, could you please attach a belonging, simplified syslog-ng config that I can use to reproduce this issue?
TIA!

-----------------------------------

Hofi - Istvan Hoffmann

https://memyselfandi.hu

https://mantisliagames.com

On Sep 17, 2025 at 17:39 +0200, Hofi <hofione@gmail.com>, wrote:

Hi,

I guess this is reported here as well.

https://github.com/syslog-ng/syslog-ng/issues/5351


We will investigate it, thanks.

Cheers

—————————————————

Hoffmann Istvan

On Sep 17, 2025 at 16:59 +0200, Evan Rempel <erempel@uvic.ca>, wrote:

We collect stats every 10 minutes via the command

syslog-ng-ctl stats --control=$syslogSocket

And we log the results  back to syslog as well as generate alerts when things start queuing.

Sometimes the queued numbers reported are extremely incorrect.

2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568
2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608

2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773
2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608

2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972
2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

It is not possible to queue more messages that the difference reported in the processed numbers.

--
Evan

______________________________________________________________________________
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq