[syslog-ng] tcp logging drops messages

[Stephen Harris]

I was attempting to test the resiliency of syslog-ng to TCP server outages
and notice that 2 messages can get lost.

I have a simple configuration:
Sending machine: Solaris 8, syslog-ng-1.6.8+20050826
Receiving machine: Linux (or Solaris, doesn't matter), ncat

syslog-ng.conf:

  options { time_reopen(1); };

  source from_file { pipe("/var/run/auth_log"); };

  destination loghost { tcp("dest" port(1234)); };

  log { source(from_file); destination(loghost);};

Sending machine:
  syslog-ng -F -d

Receiving machine:
  ncat :1234

So far, so good;  "echo msg1 > /var/run/auth_log" and I see the
message on the receiving machine.

Now kill ncat.  Do "echo msg2 > /var/run/auth_log".  No errors are seen.

Now do a "echo msg3 > /var/run/auth_log".  Now we see an error...

  io.c: do_write: write() failed (errno 32), Broken pipe
  pkt_buffer::do_flush(): Error flushing dataMarking fd 5 for closing.
  Connection broken to AF_INET(swharrislx1:1234), reopening in 1 seconds
  Closing fd 5.

So far so good!

Now another... "echo msg4 > /var/run/auth_log"
Now another ... "echo msg5 > /var/run/auth_log".

Now restart ncat.

The ncat will show "msg4" and "msg5" happily.  "msg2" and "msg3" are lost.

Any ideas?

-- 

rgds
Stephen