[Fwd: [syslog-ng]Full pipe as destination]
Peter Draexler
Peter.Draexler@mediaways.net
Tue, 21 Aug 2001 13:26:27 +0200
Dies ist eine mehrteilige Nachricht im MIME-Format.
--------------437E937F94DA26F3A468AF72
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Peter Draexler schrieb:
> Dear Bazsi,
> thank you for your info. This should help.
> Nevertheless, does syslog-ng log somewhere if it discards events or do you know
> another way to check this?
> This would be important to adapt log_fifo_size. Currently we only observe by
> chance that we lose information.
> Best regards Peter
>
> Balazs Scheidler schrieb:
>
> > On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote:
> > > Hi,
> > >
> > > We are using syslog-ng on our logserver with multifunctional
> > > logforwarding.
> > > As a special type of destination we are using pipes as a special
> > > interface to commercial applications.
> > >
> > > Here is our question:
> > > What happens with the log events, if the pipe becomes
> > > temp. unavailable (e.g. the reading end is dead or
> > > the pipe is full)?
> > >
> > > IMHO you have to open() the pipe nonblocking, to avoid your
> > > syslog stucks in-active, in the case one destination is broken.
> > > I think this is true. Correct?
> >
> > it's true.
> >
> > >
> > > What happens with your internal log buffers, if write() returns -1
> > > and errno set to EAGAIN?
> > > You implement an internal buffering/queue and try to write the
> > > outstanding log events some times later or you simply discard
> > > the buffers as long as one destination is unreachable?
> >
> > messages are queued up to the value of log_fifo_size, which IIRC can be set
> > on a per-destination basis. if the fifo is full, messages are discarded.
> >
> > >
> > > A Hint for syslog-ng.1.5.8 on Solaris 8:
> > > $DATE in destination templates returns nothing.
> > > But $FULL|ISODATE works fine.
> >
> > this seems to be fixed in my CVS tree, though it's not yet released.
> >
> > --
> > Bazsi
> > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
> >
> > _______________________________________________
> > syslog-ng maillist - syslog-ng@lists.balabit.hu
> > https://lists.balabit.hu/mailman/listinfo/syslog-ng
>
> --
> Dr. Peter Dräxler
> mediaWays GmbH
> Hülshorstweg 30
> 33415 Verl
> Tel. +49-5246-80-1888
> Fax +49-5246-80-2888
> peter.draexler@mediaways.net
> ------------------------------
>
> _______________________________________________
> syslog-ng maillist - syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
--------------437E937F94DA26F3A468AF72
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Return-Path: <syslog-ng-admin@lists.balabit.hu>
Received: from gmws-gtso-de01 ([193.189.241.129])
by messaging.mediaways.net (Netscape Messaging Server 3.6)
with SMTP id AAA5038 for <peter.draexler@mediaways.net>;
Thu, 16 Aug 2001 18:18:45 +0200
Received: from mx.mediaways.net ([193.189.224.118]) by gmws-gtso-de01.mediaways.net; Thu, 16 Aug 2001 18:18:32 +0000 (MET)
Delivered-To: @mx.mediaways.net:peter.draexler@mediaways.net
Received: (qmail 16350 invoked by uid 4220); 16 Aug 2001 16:18:30 -0000
Received: from unknown (HELO venus.terrasoft.hu) (195.70.57.147)
by mx.mediaways.net with SMTP; 16 Aug 2001 16:18:30 -0000
Received: from venus.terrasoft.hu (localhost [127.0.0.1])
by venus.terrasoft.hu (8.9.3/8.9.3/Debian 8.9.3-21) with ESMTP id RAA30490;
Thu, 16 Aug 2001 17:51:47 +0200
Delivered-To: <syslog-ng@lists.balabit.hu>
Received: from mail.mediaways.net (mail.mediaways.net [193.189.224.113])
by venus.terrasoft.hu (8.9.3/8.9.3/Debian 8.9.3-21) with SMTP id RAA30477
for <syslog-ng@lists.balabit.hu>; Thu, 16 Aug 2001 17:51:46 +0200
Received: (qmail 6290 invoked by uid 4222); 16 Aug 2001 15:51:45 -0000
Received: from messaging.mediaways.net (193.189.241.182)
by smarthost.mediaways.net with SMTP; 16 Aug 2001 15:51:45 -0000
Received: from mediaways.net ([195.71.101.244]) by messaging.mediaways.net
(Netscape Messaging Server 3.6) with ESMTP id AAA3CDC
for <syslog-ng@lists.balabit.hu>; Thu, 16 Aug 2001 17:51:44 +0200
Message-ID: <3B7BEC0C.3D455B7B@mediaways.net>
Date: Thu, 16 Aug 2001 17:51:40 +0200
From: "Peter Draexler" <Peter.Draexler@mediaways.net>
Organization: mediaWays GmbH
X-Mailer: Mozilla 4.7 [de] (WinNT; I)
X-Accept-Language: de
MIME-Version: 1.0
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng]Full pipe as destination
References: <3B78C90F.76EDFBEE@mediaways.net> <20010814132617.B6544@balabit.hu>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Reply-To: syslog-ng@lists.balabit.hu
Sender: syslog-ng-admin@lists.balabit.hu
Errors-To: syslog-ng-admin@lists.balabit.hu
X-Mailman-Version: 1.1
Precedence: bulk
List-Id: Syslog-ng users' and developers' mailing list <syslog-ng.lists.balabit.hu>
X-BeenThere: syslog-ng@lists.balabit.hu
X-Mozilla-Status2: 00000000
Dear Bazsi,
thank you for your info. This should help.
Nevertheless, does syslog-ng log somewhere if it discards events or do you know
another way to check this?
This would be important to adapt log_fifo_size. Currently we only observe by
chance that we lost information.
Best regards Peter
Balazs Scheidler schrieb:
> On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote:
> > Hi,
> >
> > We are using syslog-ng on our logserver with multifunctional
> > logforwarding.
> > As a special type of destination we are using pipes as a special
> > interface to commercial applications.
> >
> > Here is our question:
> > What happens with the log events, if the pipe becomes
> > temp. unavailable (e.g. the reading end is dead or
> > the pipe is full)?
> >
> > IMHO you have to open() the pipe nonblocking, to avoid your
> > syslog stucks in-active, in the case one destination is broken.
> > I think this is true. Correct?
>
> it's true.
>
> >
> > What happens with your internal log buffers, if write() returns -1
> > and errno set to EAGAIN?
> > You implement an internal buffering/queue and try to write the
> > outstanding log events some times later or you simply discard
> > the buffers as long as one destination is unreachable?
>
> messages are queued up to the value of log_fifo_size, which IIRC can be set
> on a per-destination basis. if the fifo is full, messages are discarded.
>
> >
> > A Hint for syslog-ng.1.5.8 on Solaris 8:
> > $DATE in destination templates returns nothing.
> > But $FULL|ISODATE works fine.
>
> this seems to be fixed in my CVS tree, though it's not yet released.
>
> --
> Bazsi
> PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
>
> _______________________________________________
> syslog-ng maillist - syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
--
Dr. Peter Dräxler
mediaWays GmbH
Hülshorstweg 30
33415 Verl
Tel. +49-5246-80-1888
Fax +49-5246-80-2888
peter.draexler@mediaways.net
------------------------------
_______________________________________________
syslog-ng maillist - syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
--------------437E937F94DA26F3A468AF72--