[syslog-ng]TCP Connection Dropouts

Rule, Ted syslog-ng@lists.balabit.hu
Mon, 17 May 2004 09:30:13 +0100

We had a Disaster Recovery test recently where I specifically tested
this exact
scenario, as I couldn't be sure that syslog-ng wouldn't block to local
Unix Domain connections.

The routed link between the central syslog-ng host and the local
syslog-ng client
was dropped to see what effect it would have - for both syslog-ng and
all other applications.

The only effect seemed to be that the client machine created an error
message every
time_reopen() seconds detailing how many messages had been lost due to
the broken connection.
To slightly reduce the number of errors caused by error messages, I
adjusted the client machine's configuration to avoid it sending any
messages generated
by syslog-ng itself up to the remote host.


> -----Original Message-----
> From: syslog-ng-admin@lists.balabit.hu=20
> [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Philip Webster
> Sent: Monday May 17 2004 05:06
> To: syslog-ng@lists.balabit.hu
> Subject: [syslog-ng]TCP Connection Dropouts
> Hello,
> I'm wondering about the resilience of syslog-ng to TCP=20
> connection dropouts.=20
> I've tested what happens when there is no connection=20
> available - syslog-ng=20
> buffers the output and continues to write to local files, ie.=20
> it doesn't block.
> But what happens if the TCP connection fails halfway through?=20
>  So, for=20
> example, the three-way handshake has been completed, but=20
> there is no response=20
> after the first data packet is sent because the remote host=20
> (or router,=20
> switch, ISP ...) has stopped responding.  I can't really test=20
> this, so does=20
> anyone know how syslog-ng handles it?
> Thanks
> Phil
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

This E-mail message, including any attachments, is intended only for the pe=
or entity to which it is addressed, and may contain confidential informatio=
If you are not the intended recipient, any review, retransmission, disclosu=
copying, modification or other use of this E-mail message or attachments is
strictly forbidden.
If you have received this E-mail message in error, please contact the autho=
r and
delete the message and any attachments from your computer.
You are also advised that the views and opinions expressed in this E-mail
message and any attachments are the author's own, and may not reflect the v=
and opinions of FLEXTECH Television Limited.