Whilst working further on this problem, I was tailing the log and this popped up: /var/log/syslog:Oct 10 13:50:01 mylogserver syslog-ng[20167]: do_stream_read: getmsg() trying to return too much ctl data, res=4294967295 Resource temporarily unavailable Is this any clue to the problem we are having? How do I interpret that message? I don't find any info on it in Google or this list...

Date: Mon, 9 Oct 2006 09:19:42 -0700 From: Kim Cary <Kim.Cary@pepperdine.edu> Subject: [syslog-ng] 1.6.11 stops logging on Garbage Collect (Solaris 9) To: syslog-ng@lists.balabit.hu Message-ID: <9B0A23E1-566A-465A-BB00-BA3FF0EA0FBC@pepperdine.edu> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed

Our installation of syslog-ng writes to 3 pipes and a dozen files from 2 IP sources.

About 2-3 times a week it will stop logging in 1-12 files. The last record in these files will almost always coincide with a Garbage Collect record in /var/log/syslog (which always continues to collect records).

Solaris syslog is NOT running. Solaris logadm sends HUP to syslog-ng on any rotate. We tried TCP logging from some systems for a while, but its all UDP now.

Important to note, it may not be all files that stop receiving records, or even all the files from a single source.

We need reliable logs. How do we begin to debug this issue?