[syslog-ng] Reliable tcp logging

[Roberto Nibali]

> I am trying to send all important messages from a bunch of
> other machines to a central syslog-ng server via tcp. I chose
> tcp partly, because the same log server gets all kinds of less
> important stuff via udp from other machines, which can easily
> be distinguished that way, but partially also because I expected
> tcp to be more reliable. Unfortunately, this does not seem to be
> the case: When the connection has died for any reason, the client
> will only discover this when it is trying to send the next message
> to the server. Only then it starts to wait until "time_reopen" is
> over and establishes a new connection - the message that originally
> triggered this and whatever comes in between is lost.

Related if not exactly matching to (IHMO):

https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html

Only the first message is lost, however.

> Is there any way to get syslog-ng (v 1.6.5) to check more often
> whether a tcp connection to a log host still exists and re-establish
> it otherwise? I did not see any reference to this in the documentation,
> but this seems to happen every 2 hours.

The problem is rather that the packet is now available anymore.

> Setting "tcp-keep-alive(yes)" does not seem to make it any better.
> I also discovered that version 1.6.7 has a new option "log_fifo_size"
> which sounded promising but setting this to a higher value also does
> not seem to have any influence on this issue.

Correct.

If your problem matches the archive's email, you could start off Bazsi's last
reply and find a solution to that ;).

Regards,
Roberto Nibali, ratz
-- 
-------------------------------------------------------------
addr://Rathausgasse 31, CH-5001 Aarau  tel://++41 62 823 9355
http://www.terreactive.com             fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG                       Wir sichern Ihren Erfolg
-------------------------------------------------------------