Hi,

I have a "client" syslog-ng that reads from a unix domain socket and writes to a file destination as well as a tcp destination. I have a "server" syslog-ng listening on 0.0.0.0 on the port specified in the "client" tcp destination.

When I write a sample payload to the domain socket, syslog-ng writes the message in full to the file destination immediately. However I see no file created on the host referred to by tcp destination.

If I write a second payload, the first payload is now written to the remote location specified in the tcp destination.

It seems like syslog-ng is always one message behind in writing to the tcp destination.

I am able to flush the "client" syslog-ng buffer by sending a kill -1. This causes the payload to be written to the tcp destination.

Is this the only way to force syslog-ng to write all its buffer contents to the tcp destination? Or is there someway to control the flushing using flow-control?

"client" syslog-ng configuration:

@version: 3.0

options { flush_timeout(1000); };

source s_socks { unix-stream ("/home/srini/dev/log" max-connections(5) log_msg_size(3145728) flags(no-parse));

};

destination d_logs { file("/logs/app.log"); };

destination d_tcp { tcp("192.168.1.102" port(60999) frac_digits(6) keep-alive(yes) ); };

rewrite r_rewrite_newlines{ subst("#012", "\n", value("MESSAGE"), flags("global")); };

log { source(s_socks); rewrite(r_rewrite_newlines); destination(d_logs); };

log { source(s_socks); destination(d_tcp); };

"Server" syslog-ng: This is the "centralized" log server:

@version: 3.0

source s_tcp { tcp(port(60999)) log_msg_size(3145728) keep-alive(yes) };

destination d_logs { file("/logs/app.llog" };

rewrite r_rewrite_newlines{ subst("#012", "\n", value("MESSAGE"), flags("global")); };

log { source(s_tcp); rewrite(r_rewrite_newlines); destination(d_logs); };

Thanks. Srini