I have the same "expr" logs going to file AND sql. With file-only logging it works great.

When I'm enabling SQL logging it stops writing both to file and to sql ~1-10min(from 10 000 to 200 000 lines) after start.

Every time there are no dropped messages, but 1000 stored for SQL location.

number of nodes: ~150
max-connections(200)
log_iw_size(20000)
log_fetch_limit(100)
log_fifo_size (400000);
flush_lines(100)
flush_timeout(100)
flags(flow-control) # the same issue with and without flow control

syslog-server ~ % sudo syslog-ng-ctl stats | sort -rnk6 -t ";" | grep expr

dst.file;d_app_expr#0;/logs/app/expr.log;o;processed;30457

destination;d_app_expr;;a;processed;30457

destination;d_mysql_expr;;a;processed;30003

dst.sql;d_mysql_expr#0;mysql,mysql-db-ip,port,syslog_production,expr_${HOST}_${R_Y;a;stored;1000

dst.sql;d_mysql_expr#0;mysql,mysql-db-ip,port,syslog_production,expr_${HOST}_${R_Y;a;dropped;0

dst.file;d_app_expr#0;/logs/app/expr.log;o;stored;0

dst.file;d_app_expr#0;/logs/app/expr.log;o;dropped;0

I see no errors in syslog-ng debug logs or mysql error log.

After restarting syslog-ng it writes both logs for some time and stops again.

I will appreciate any help.

Additional question: is there any mysqltuner.pl-like tool for syslog-ng? I don't feel happy to tune all those buffers and windows manually with no being sure it will help.

--
Best regards,
Koldaev Anton