[syslog-ng] Syslog-ng appears to hang for local requests to log

Russell Fulton r.fulton at auckland.ac.nz
Mon Aug 6 20:27:12 CEST 2007



Balazs Scheidler wrote:
> On Mon, 2007-08-06 at 11:56 +1200, Russell Fulton wrote:
>   
>> I have just upgraded to 2.0.5 but another thing has just occurred to
>> me.  I have a destination fifo which is used intermittently.  Fifo has
>> an 8KB buffer and I just wondered what happens when this fills.  Do
>> writes from syslog-ng fail? If so does syslog-ng then try and buffer
>> output itself?  If so that would explain what we are seeing.
>>
>> If the new version does not fix the issue I will try disabling the fifo
>> destination.
>>     
>
> It depends on the flow-control setting of the log-path with the fifo
> destination.
>
> If flow-control is enabled and the fifo is not read, then the input side
> of syslog-ng will be suspended, thus the applications trying to send
> messages will be blocked.
>
> That's how flow-control behaves. See the chapter on flow-control in the
> manual.
>   

Wow!  I had not seen the new manual!  Great! 

OK, I've read the section on flow control and now believe that I
understand what happens when flow-control is set.  I am still a bit
confused about what happens by default.

In my case I have two destinations -- normal files and a fifo.  
Everything goes to the file destination and a selection also goes to the
fifo which is used for 'real time' analysis (which is currently under
development and  not running all the time).  Clearly my sources are not
blocking  when the output buffer is full because logs continue to be
written to disk.   I assume that in the absence of flow-control
syslog-ng discards records once the output buffer becomes full.  
Perhaps this could be stated explicitly for idiots like me.

Is this interpretation correct?

Russell




More information about the syslog-ng mailing list