[syslog-ng]TCP reliability

Balazs Scheidler bazsi@balabit.hu
Tue, 15 May 2001 11:24:09 +0200

On Mon, May 14, 2001 at 04:45:47PM -0400, Chris Sibbitt wrote:
>  Greetings. I'm running syslog-ng 1.4.11 and am having trouble getting the
> tcp destination to work reliably. My major concern is with what happens when
> the receiving end of the tcp link is reset. In my scenario I have one
> syslog-ng machine forwarding messages to another syslog-ng machine using a
> tcp() destination on one end and a tcp() source on the other. All works fine
> until I interrupt the socket on the receiving machine. Rebooting, HUP'ing
> syslog-ng, etc all cause the logs to stop coming in. I assume that the
> sender is simply trying to write the messages to an existing TCP socket and
> failing. What happens to these messages (are they queued anywhere for later
> delivery?), and is there anything that I can do to ensure that messages
> continue to flow when the receiver comes back up? Losing messages while the
> receiving end if offline is an acceptable loss, but when it comes back up, I
> would really like it to continue to receive. In the current scenario I have
> to restart every syslog-ng machine that is forwarding messages to my central
> logger when I change its configuration, this is definitely not sane.
>  Anyone with hints/tips for setting up TCP based messaging, please contact
> me.

syslog-ng should reconnect every 60 seconds or so when a TCP connection is
broken. However some earlier reports indicated that sometimes it doesn't do
so, but I was unable to reproduce the problem here. So your help to debug
the problem is appreciated.

PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1