[syslog-ng] Re: Reliable tcp logging

[Dave Johnson]

Assuming you already tried to find out what was causing the drop on
the remote side (firewall/remote server/unknown?), and this can't be
tuned, some other random ideas:

1) send udp and tcp to the central server, compare files at end of day 
  (assuming you rotate them every day)

2) run a keepalive message sender:
  [make sure your sync is (0) for the connection(s)]:
   a) cronjob every couple minutes to logger a "keepalive"
      - Filter the message out at the central server.
   b) have syslog-ng send stats every couple minutes and send it to the
       central server.


On 5/11/05, Peter Daum <gator_ml at yahoo.de> wrote:
> Roberto Nibali wrote:
> 
> > Related if not exactly matching to (IHMO):
> >
> > https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html
> >
> > Only the first message is lost, however.
> 
> Well, yes, it is exactly the same issue and it is indeed only one line
> that gets lost (which in my case, where typically every host sends about
> 1 line/hour does not really make a difference).
> 
> Unfortunately, the previous discussion does not sound very promising.
> Obviously there is no hope to get this fixed in 1.6.x...
> 
> How far from being ready for production use is 1.9.x?
> 
> Maybe I should go back to using udp instead, which is by definition
> unrealiable, but in this case probably would still yield a higher
> success rate?
> 
> Regards,
>                 Peter Daum
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 
>