[syslog-ng]Strang behaviour of syslog-ng (and my program)
Michael Earls
Michael.Earls@chmcc.org
Thu, 11 Jul 2002 10:12:47 -0400
This is a MIME message. If you are reading this text, you may want to
consider changing to a mail reader or gateway that understands how to
properly handle MIME multipart messages.
--=_94C8897E.F495F991
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
What ver of syslog-ng? and what distro are u running syslog-ng on? what
does your config look like?
michael
>>> aning@jetnet.ca 07/11/02 09:49AM >>>
Just add a little more info, if I send the first 10 messages a little
bit slower, say delay 10 msec in between, then it doesn't happen.
-----Original Message-----
From: Antai Ning [mailto:aning@jetnet.ca]
Sent: Wednesday, July 10, 2002 1:38 PM
To: 'syslog-ng@lists.balabit.hu'
Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program)
Hi Gurus,
I got some strange phenomemon with syslog-ng. Here is what I'm doing.
I configured syslog-ng to forward certain type of messages to a pipe.
(say, ALERT). I wrote a program in perl to read from the pipe and print
them out. The perl program first try to open the pipe and it'll block at
the open function untill syslog-ng has some messages to write to the
pipe. Then the perl program reads using IO::File can_read() function,
with a 5 seconds timeout. So the function looks like this:
$sel->can_read(5). Then I send 10 valid messages to syslog-ng from a
remote machine by UDP. To my supprise, the perl program got only 2 of
the 10! Then I send another 1 valid message to this syslog-ng after 5
minutes, and I got not only this message, but also the 8 I lost last
time!
This happens only for the first 10 messages (which includes the opening
of the pipe). Everything is fine after the first round. It looks like
it's related to the pipe opening and messages get queued somewhere until
later messages trigger the queue to flush.
So what's really happening inside? And is there a solution?
Thanks,
Andy
--=_94C8897E.F495F991
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Content-Description: HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4807.2300" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 8pt Tahoma; MARGIN-LEFT: 2px">
<DIV><FONT size=2>What ver of syslog-ng? and what distro are u running
syslog-ng on? what does your config look like?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>michael</FONT></DIV>
<DIV><BR><BR>>>> aning@jetnet.ca 07/11/02 09:49AM
>>><BR></DIV>
<DIV><SPAN class=150044213-11072002><FONT face=Arial color=#0000ff size=2>Just
add a little more info, if I send the first 10 messages a little bit slower, say
delay 10 msec in between, then it doesn't happen. </FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Antai Ning
[mailto:aning@jetnet.ca]<BR><B>Sent:</B> Wednesday, July 10, 2002 1:38
PM<BR><B>To:</B> 'syslog-ng@lists.balabit.hu'<BR><B>Subject:</B>
[syslog-ng]Strang behaviour of syslog-ng (and my program)<BR><BR></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=710041517-10072002>Hi
Gurus,</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=710041517-10072002>I
got some strange phenomemon with syslog-ng. Here is what I'm
doing.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=710041517-10072002>I
configured syslog-ng to forward certain type of messages to a pipe. (say,
ALERT). I wrote a program in perl to read from the pipe and print them
out. The perl program first try to open the pipe and it'll block at the
open function untill syslog-ng has some messages to write to the pipe.
Then the perl program reads using IO::File can_read() function, with
a 5 seconds timeout. So the function looks like this: $sel->can_read(5).
Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my
supprise, the perl program got only 2 of the 10! Then I send
another 1 valid message to this syslog-ng after 5 minutes, and I got not
only this message, but also the 8 I lost last
time! </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=710041517-10072002>This
happens only for the first 10 messages (which includes the opening of the
pipe). Everything is fine after the first round. It looks like it's
related to the pipe opening and messages get queued somewhere until later
messages trigger the queue to flush.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=710041517-10072002>So
what's really happening inside? And is there a
solution?</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002>Thanks,</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=710041517-10072002>Andy </SPAN></FONT></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px"><FONT face=Arial color=#0000ff
size=2></FONT> </BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>
--=_94C8897E.F495F991--