Also, Even, could you please elaborate? What version of syslog-ng produces this? (Please attach the output of `syslog-ng -V`) Are you using `syslog-ng-ctl stats —reset` or `syslog-ng-ctl reload` when you experience this problem? TIA! ————————————————— Hoffmann Istvan On Oct 6, 2025 at 10:57 +0200, Hofi <hofione@gmail.com>, wrote:

Evan, could you please attach a belonging, simplified syslog-ng config that I can use to reproduce this issue? TIA!

----------------------------------- Hofi - Istvan Hoffmann https://memyselfandi.hu https://mantisliagames.com On Sep 17, 2025 at 17:39 +0200, Hofi <hofione@gmail.com>, wrote:

...

Hi,

I guess this is reported here as well.

https://github.com/syslog-ng/syslog-ng/issues/5351

We will investigate it, thanks.

Cheers

————————————————— Hoffmann Istvan On Sep 17, 2025 at 16:59 +0200, Evan Rempel <erempel@uvic.ca>, wrote:

...

We collect stats every 10 minutes via the command

syslog-ng-ctl stats --control=$syslogSocket

And we log the results  back to syslog as well as generate alerts when things start queuing.

Sometimes the queued numbers reported are extremely incorrect.

2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15568 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15773 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608 2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;processed;15972 2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0 2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unknown.20250916.000000;a;queued;0

It is not possible to queue more messages that the difference reported in the processed numbers.

-- Evan ______________________________________________________________________________ Member info: %(web_page_url)slistinfo/%(_internal_name)s Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq