[syslog-ng] zero-loss from source{pipe()}

Jon Stearley jrstear at sandia.gov
Wed Apr 12 18:02:07 CEST 2006

manual snippet: "syslog-ng always reads its incoming log channels to  
prevent the running daemons from blocking."  log_fifo_size() is  
offered as mitigation strategy.  is there a way to force syslog-ng  
not to do this - option i've missed (or undocumented), preprocessor  
DEFINE, etc?

why: i want to re-bin some historical logs into a $YEAR/$MONTH/$DAY/ 
$HOUR/$HOST file layout.  syslog-ng is configured with a source pipe  
and destination as above, and fed via a fifo:
   find /historical/log/dir -type f -exec cat {} /tmp/myfifo \;
but the resulting output dir is only 1/3 the size of the input dir.   
syslog-ng internal() messages include:
   syslog-ng[425]: Cannot open file /scratch/ptest/2005/05/13/13/sn5  
for writing (No such file or directory)
   syslog-ng[425]: STATS: dropped 0

"dropped 0" seems inaccurate.  this continues to happen even when  
log_fifo_size() is set higher than the maximum actual number of lines  
in an output file (which i happen to know for this test case).  i  
could throttle feeding the pipe, but then it's trial-and-error to  
find the zero-loss rate.  is there a better way?

i'm running syslog-ng 1.6.0 on an old debian box, but since 1.6.x and  
1.9.x manuals both contain the statement above i doubted an upgrade  
would behave differently in this respect?  so i thought i'd ask.   
many thanks!

| Jon Stearley                  (505) 845-7571  (FAX 844-9297) |
| Sandia National Laboratories  Scalable Systems Integration   |

More information about the syslog-ng mailing list