[syslog-ng] Syslog-ng to Pipe question

[SOLIS, ALEX]

I have syslog-ng sending all logs to a named pipe so that a separate
program can monitor and alert on log events real-time.  This works great
and I am very happy with the setup.  However, last night my separate
program that monitors the pipe died and stopped retrieving messages from
the pipe.  What surprises me is that for every subsequent hour after the
monitoring program died, syslog-ng reported dropped messages.  This is
very uncommon for my installation and I suspect it has something to do
with the monitoring program failing and abandoning the pipe.

My question to the experts of the list is why would syslog-ng start
dropping messages after a separate program reading syslog-ng's
destination fifo dies?  Is it just coincidence that my monitoring
program died at exactly the hour I started getting dropped stats?


Just for fun, here is a piece of the stat logs:

Jul 19 12:05:19 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 13:05:20 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 14:05:20 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 15:05:20 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 16:05:20 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 17:05:20 watchout syslog-ng[20350]: STATS: dropped 0
Jul 19 18:05:20 watchout syslog-ng[20350]: STATS: dropped 4220
Jul 19 19:05:20 watchout syslog-ng[20350]: STATS: dropped 3187
Jul 19 20:05:21 watchout syslog-ng[20350]: STATS: dropped 2952
Jul 19 21:05:21 watchout syslog-ng[20350]: STATS: dropped 2510
Jul 19 22:05:21 watchout syslog-ng[20350]: STATS: dropped 2723
Jul 19 23:05:22 watchout syslog-ng[20350]: STATS: dropped 2903
Jul 20 00:05:22 watchout syslog-ng[20350]: STATS: dropped 2774
Jul 20 01:05:22 watchout syslog-ng[20350]: STATS: dropped 2461

As you can see, my monitoring program died sometime before 18:00 hours;
or 17:33 to be exact. :)



Thanks.

Alex


This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient.  Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance.  If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.