[syslog-ng] Reliability of Remote logging via TCP/Syslog-NG

[Olaf Hoyer]

On Wed, 15 Jun 2005, Balazs Scheidler wrote:

> On Wed, 2005-06-15 at 03:59 -0700, Alf wrote:
>> Hi Balas and guys,
>>
>> --- Balazs Scheidler <bazsi at balabit.hu> wrote:
>>> syslog-ng has a FIFO in memory where it stores messages. The contents of
>>> this fifo is not persistent (as it is in memory), thus if you stop and
>>> restart syslog-ng the contents of this fifo is lost. Another thing to
>>> note is that if this FIFO becomes full, syslog-ng will start dropping
>>> messages (which it reports using the STATS message).
>>  So assuming FIFO doesnt become full, I can assume messages that failed to send
>> will be requeued to be sent ?
>
> One other problem is that whenever the server shuts down the connection
> the client drops a _single_ log message. This is not easy to fix, at
> least not in the 1.6.x branch. See the mailing list archives for more
> information.


Hi!

When I read that correctly, this means that on the client machine a 
single line of data is thrown away, before it will reach the network 
interface?


I am also doing some syslog setup, where some embedded machines (running 
syslog-ng 1.5.17) will log to a central machine, also running syslog-ng 
1.6.x, and I wonder, that, wenn on the client machine there is no data 
waiting, what happens to the first line arriving, when the connection is 
up again before this line arrives? I assume it shall be transmitted 
unharmed, or is there anything to worry about?

With kind regards
Olaf Hoyer
-- 
Olaf Hoyer        ohoyer at ohoyer.de
Fuerchterliche Erlebniss geben zu raten,
ob der, welcher sie erlebt, nicht etwas Fuerchterliches ist.
(Nietzsche, Jenseits von Gut und Boese)