Assuming you already tried to find out what was causing the drop on the remote side (firewall/remote server/unknown?), and this can't be tuned, some other random ideas: 1) send udp and tcp to the central server, compare files at end of day (assuming you rotate them every day) 2) run a keepalive message sender: [make sure your sync is (0) for the connection(s)]: a) cronjob every couple minutes to logger a "keepalive" - Filter the message out at the central server. b) have syslog-ng send stats every couple minutes and send it to the central server. On 5/11/05, Peter Daum <gator_ml@yahoo.de> wrote:
Roberto Nibali wrote:
Related if not exactly matching to (IHMO):
https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html
Only the first message is lost, however.
Well, yes, it is exactly the same issue and it is indeed only one line that gets lost (which in my case, where typically every host sends about 1 line/hour does not really make a difference).
Unfortunately, the previous discussion does not sound very promising. Obviously there is no hope to get this fixed in 1.6.x...
How far from being ready for production use is 1.9.x?
Maybe I should go back to using udp instead, which is by definition unrealiable, but in this case probably would still yield a higher success rate?
Regards, Peter Daum
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html