On Mon, Oct 09, 2006 at 09:19:42AM -0700, Kim Cary wrote:

Our installation of syslog-ng writes to 3 pipes and a dozen files from 2 IP sources.

About 2-3 times a week it will stop logging in 1-12 files. The last record in these files will almost always coincide with a Garbage Collect record in /var/log/syslog (which always continues to collect records).

Solaris syslog is NOT running. Solaris logadm sends HUP to syslog-ng on any rotate. We tried TCP logging from some systems for a while, but its all UDP now.

Important to note, it may not be all files that stop receiving records, or even all the files from a single source.

We need reliable logs. How do we begin to debug this issue?

This doesn't sound like your problem, but is worth mentioning just in case: most of the times I had syslog-ng stop logging to files was because I ran out of filehandles and had to set a higher limit for the syslog-ng process. -- Nate "Usenet is like a herd of performing elephants with diarrhea-- massive, difficult to redirect, awe-inspiring, entertaining, and a source of mind-boggling amounts of excrement when you least expect it." - Spafford, Gene