[syslog-ng] Syslog-ng to Pipe question

[Valdis.Kletnieks at vt.edu]

> My question to the experts of the list is why would syslog-ng start
> dropping messages after a separate program reading syslog-ng's
> destination fifo dies?  Is it just coincidence that my monitoring
> program died at exactly the hour I started getting dropped stats?

<mode silly>
Imagine a cardboard tube, several feet long and several inches in diameter.
We give one guy a *big* basket of balls, and he starts putting the balls into
one end of the tube, one by one.  Meanwhile, we have another guy at the
other end, taking balls out one at a time.

Now this second guy decides it's time for a nap, so he stops taking balls out
and tapes something across the end of the tube so balls won't fall out
accidentally.  Eventually, the tube gets full, and when the guy with the
basket tries to put another ball in, it doesn't fit, and just gets dropped
on the floor.
</mode>

In other words, there's a limit to how much buffering a pipe with no reader
will give you before it starts complaining, and yes, it's no coincidence that
it started dropping messages when the program reading the pipe went away.

After all, what *else* was it supposed to do with them at that point? ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060720/703f8a32/attachment.pgp