Hi, We are using syslog-ng on our logserver with multifunctional logforwarding. As a special type of destination we are using pipes as a special interface to commercial applications. Here is our question: What happens with the log events, if the pipe becomes temp. unavailable (e.g. the reading end is dead or the pipe is full)? IMHO you have to open() the pipe nonblocking, to avoid your syslog stucks in-active, in the case one destination is broken. I think this is true. Correct? What happens with your internal log buffers, if write() returns -1 and errno set to EAGAIN? You implement an internal buffering/queue and try to write the outstanding log events some times later or you simply discard the buffers as long as one destination is unreachable? Thanks very much. Best Regards -- Andreas and Peter A Hint for syslog-ng.1.5.8 on Solaris 8: $DATE in destination templates returns nothing. But $FULL|ISODATE works fine. -- Dr. Peter Dräxler mediaWays GmbH Hülshorstweg 30 33415 Verl Tel. +49-5246-80-1888 Fax +49-5246-80-2888 peter.draexler@mediaways.net ------------------------------
On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote:
Hi,
We are using syslog-ng on our logserver with multifunctional logforwarding. As a special type of destination we are using pipes as a special interface to commercial applications.
Here is our question: What happens with the log events, if the pipe becomes temp. unavailable (e.g. the reading end is dead or the pipe is full)?
IMHO you have to open() the pipe nonblocking, to avoid your syslog stucks in-active, in the case one destination is broken. I think this is true. Correct?
it's true.
What happens with your internal log buffers, if write() returns -1 and errno set to EAGAIN? You implement an internal buffering/queue and try to write the outstanding log events some times later or you simply discard the buffers as long as one destination is unreachable?
messages are queued up to the value of log_fifo_size, which IIRC can be set on a per-destination basis. if the fifo is full, messages are discarded.
A Hint for syslog-ng.1.5.8 on Solaris 8: $DATE in destination templates returns nothing. But $FULL|ISODATE works fine.
this seems to be fixed in my CVS tree, though it's not yet released. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
Dear Bazsi, thank you for your info. This should help. Nevertheless, does syslog-ng log somewhere if it discards events or do you know another way to check this? This would be important to adapt log_fifo_size. Currently we only observe by chance that we lost information. Best regards Peter Balazs Scheidler schrieb:
On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote:
Hi,
We are using syslog-ng on our logserver with multifunctional logforwarding. As a special type of destination we are using pipes as a special interface to commercial applications.
Here is our question: What happens with the log events, if the pipe becomes temp. unavailable (e.g. the reading end is dead or the pipe is full)?
IMHO you have to open() the pipe nonblocking, to avoid your syslog stucks in-active, in the case one destination is broken. I think this is true. Correct?
it's true.
What happens with your internal log buffers, if write() returns -1 and errno set to EAGAIN? You implement an internal buffering/queue and try to write the outstanding log events some times later or you simply discard the buffers as long as one destination is unreachable?
messages are queued up to the value of log_fifo_size, which IIRC can be set on a per-destination basis. if the fifo is full, messages are discarded.
A Hint for syslog-ng.1.5.8 on Solaris 8: $DATE in destination templates returns nothing. But $FULL|ISODATE works fine.
this seems to be fixed in my CVS tree, though it's not yet released.
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
-- Dr. Peter Dräxler mediaWays GmbH Hülshorstweg 30 33415 Verl Tel. +49-5246-80-1888 Fax +49-5246-80-2888 peter.draexler@mediaways.net ------------------------------
participants (2)
-
Balazs Scheidler
-
Peter Draexler