[syslog-ng] Syslog-ng appears to hang for local requests to log

[Balazs Scheidler]

On Tue, 2007-08-07 at 06:27 +1200, Russell Fulton wrote:
> 
> Balazs Scheidler wrote:
> > On Mon, 2007-08-06 at 11:56 +1200, Russell Fulton wrote:
> >   
> >> I have just upgraded to 2.0.5 but another thing has just occurred to
> >> me.  I have a destination fifo which is used intermittently.  Fifo has
> >> an 8KB buffer and I just wondered what happens when this fills.  Do
> >> writes from syslog-ng fail? If so does syslog-ng then try and buffer
> >> output itself?  If so that would explain what we are seeing.
> >>
> >> If the new version does not fix the issue I will try disabling the fifo
> >> destination.
> >>     
> >
> > It depends on the flow-control setting of the log-path with the fifo
> > destination.
> >
> > If flow-control is enabled and the fifo is not read, then the input side
> > of syslog-ng will be suspended, thus the applications trying to send
> > messages will be blocked.
> >
> > That's how flow-control behaves. See the chapter on flow-control in the
> > manual.
> >   
> 
> Wow!  I had not seen the new manual!  Great! 
> 
> OK, I've read the section on flow control and now believe that I
> understand what happens when flow-control is set.  I am still a bit
> confused about what happens by default.
> 
> In my case I have two destinations -- normal files and a fifo.  
> Everything goes to the file destination and a selection also goes to the
> fifo which is used for 'real time' analysis (which is currently under
> development and  not running all the time).  Clearly my sources are not
> blocking  when the output buffer is full because logs continue to be
> written to disk.   I assume that in the absence of flow-control
> syslog-ng discards records once the output buffer becomes full.  
> Perhaps this could be stated explicitly for idiots like me.
> 
> Is this interpretation correct?

Yes, absolutely. The bit about dropping messages when the buffer is full
might be missing from the manual for the very reason it did this all the
time. (until flow-control was introduced).

I'm Cc-ing our documentation team to consider adding a note about this 
to that chapter.

-- 
Bazsi