[syslog-ng] remote logging not reliable

[stucky]

Nate

thanks for your reply ! I am already using keepalive on the server :

tcp (ip("**********")
       port(5000)
       max-connections(1000)
       keep-alive(yes)); };

It doesn't look like I can specify this option on the client though. If I
try something like :
destination loghost { tcp("*********" port(5000) keep-alive(yes)); };

It complains about a syntax error. I have never seen an option called
'tcp-keep-alive()' but I tried it without
luck. It always complains about a syntax error. I guess you meant
'keep-alive(yes)' right ?

As far as upgrading is concerned I want to but I wanted to wait till 2.0 is
out and stable. Any ETA ?


--stucky

On 3/2/06, Nate Campi <nate at campin.net> wrote:
>
> On Tue, Feb 28, 2006 at 11:09:43AM -0800, stucky wrote:
> > guys
> >
> > I've been pulling my hair out here. I gonna go insane....
> >
> > Here's the story.
> >
> > I first setup syslog-ng-1.6.6 for remote syslogging a year ago.
> >
> > I seemed to work out great  - all my stuff appeared to be logged
> remotely
> > and everything was dandy.
> > Then I decided to come up with some sort of check that would tell me if
> a
> > machine was not logging remotely anymore
> > cause of network problems or whatever.
>
> I'm thinking that since you use TCP that perhaps the messages only come
> through once in a while, and since the first message sent when a TCP
> connection comes up used to be lost (might still be, but I remember
> Bazsi coming up with a workaround/fix at some point) then you might
> actually lose messages the way you report.
>
> Either try using UDP for a short while or try tcp-keep-alive() to keep
> the connection up. Also review the changelogs to see if a newer version
> fixes this behavior (probably a good idea to upgrade anyways).
>
> HTH,
> --
> Nate
>
> He may look like an idiot and talk like an idiot but don't let that fool
> you. He really is an idiot. - Groucho Marx
>
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060302/071781fa/attachment.html