Re: [syslog-ng] message loss using multi-line-mode
Hi, opening a new issue is not necessary. I hope that a GSoC student will solve this issue. BTW GSoC: we are still looking for feature owners to our GSoC[1] projects[2]. As an experienced syslog-ng user you could join to us. What do you think? [1] https://syslog-ng.org/gsoc-2016/ [2] https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html regards, Laszlo Budai Sent from my HTC ----- Reply message ----- From: "Patrick Hemmer" <syslogng@stormcloud9.net> To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Subject: [syslog-ng] message loss using multi-line-mode Date: Tue, May 17, 2016 00:17 Anybody? Should I open a new issue? -Patrick On 2016/3/28 12:01, Patrick Hemmer wrote:
I raised issue on an existing bug on the github tracker, but it seems to have gone unnoticed, so I'm repeating it here to try and get some attention on the issue.
Using multi-line-mode without the multi-line-suffix option WILL result in message loss. When syslog-ng is running in multi-line-mode, it buffers multi-line messages until it sees the start of a new message. When it sees the start of a new message, it flushes the buffered message, and puts the first line of the new message in the buffer. However if syslog-ng shuts down, or receives a SIGHUP (reload), any lines currently buffered are discarded. Given that syslog-ng can't stay running forever, and it will get shut down or SIGHUPd eventually, using this feature will result in messages getting lost.
The message on the github issue where I brought this up is: https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887
-Patrick
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hello! In a few weeks my university tasks will be done. After that I would like to take a look at the problem and if I can fix it, I will do it. :) Also, it would be great if you could be the feature owner of my project! My project is the syslog-ng as a command line tool. It could help you to test syslog-ng configuration for example. :) Regards, kvch On 19 May 2016 at 06:20, Laszlo Budai <laszlo.budai@outlook.com> wrote:
Hi,
opening a new issue is not necessary. I hope that a GSoC student will solve this issue.
BTW GSoC: we are still looking for feature owners to our GSoC[1] projects[2]. As an experienced syslog-ng user you could join to us. What do you think?
[1] https://syslog-ng.org/gsoc-2016/ [2] https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html
regards, Laszlo Budai
Sent from my HTC
----- Reply message ----- From: "Patrick Hemmer" <syslogng@stormcloud9.net> To: "Syslog-ng users' and developers' mailing list" < syslog-ng@lists.balabit.hu> Subject: [syslog-ng] message loss using multi-line-mode Date: Tue, May 17, 2016 00:17
Anybody? Should I open a new issue?
-Patrick
On 2016/3/28 12:01, Patrick Hemmer wrote:
I raised issue on an existing bug on the github tracker, but it seems to have gone unnoticed, so I'm repeating it here to try and get some attention on the issue.
Using multi-line-mode without the multi-line-suffix option WILL result in message loss. When syslog-ng is running in multi-line-mode, it buffers multi-line messages until it sees the start of a new message. When it sees the start of a new message, it flushes the buffered message, and puts the first line of the new message in the buffer. However if syslog-ng shuts down, or receives a SIGHUP (reload), any lines currently buffered are discarded. Given that syslog-ng can't stay running forever, and it will get shut down or SIGHUPd eventually, using this feature will result in messages getting lost.
The message on the github issue where I brought this up is: <https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887> https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887
-Patrick
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (2)
-
Laszlo Budai
-
Noémi Ványi