Thanks for the pointer! That's a relief in a way... I'd hate to guilty of crying 'bug' and be wrong. Fortunately UDP is an option, so I'll go that route instead.
Here's a link to discussion of the one line lost during TCP connection issue:
http://marc.theaimsgroup.com/?l=syslog-ng&m=110742087620842&w=2
There is a known bug related to the first message getting dropped under certain circumstances. I think it is when a TCP connection is established though, is this consistent for you or only when the TCP connection is (re-)established?
I have a postfix server logging via syslog-ng. The log data is written to a local file and also sent via TCP to a central syslog-ng loghost.
On the source server (syslog-ng 1.6.6 on Linux) I see:
05:32:21 internal/smtpd[15534]: 9AE172D29A5: client=x.x.net[10.x.x.x] 05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x@x.com>, size=1557811, nrcpt=1 (queue active)
On the central loghost (syslog-ng 1.6.5 on Linux) I see:
05:32:21 syslog-ng[28919]: AF_INET client connected from 10.x.x.x, port 33645
and
05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x@x.com>, size=1557811, nrcpt=1 (queue active)
The 1st line from the source server is missing on the central loghost. Is this a bug?