[syslog-ng]TCP transport reliability

Jeffrey W. Baker jwbaker@acm.org
Thu, 4 Jan 2001 09:45:17 -0800 (PST)

On Thu, 4 Jan 2001, Jon Marks wrote:

> Hello,
> I'm testing syslog-ng with TCP transport, and I'm a little surprised-
> perhaps I'm doing something wrong? I'm finding severe message loss,
> which I had imagined TCP would eliminate.

I've reported the same thing on this list in the past.  Indeed, my
machines can even lose messages when the input is a pipe and the output is
a local file!

The culprit is this bit of code at line 71 in libol:

        if (self->queue_size == self->queue_max) {
                /* fifo full */
                return ST_FAIL | ST_OK;

If the queue is full, your message is dismissed and cannot be recovered.
If you put a printf() statement in that code block, I bet you will see
that you are hitting this misfeature.  I tried fixing this problem, but
there is not a simple way.  It requires significant changes to syslog-ng's
message handling loop.