[syslog-ng] File source and flow-control question

Balazs Scheidler bazsi at balabit.hu
Sat Dec 1 15:42:19 CET 2007


On Fri, 2007-11-30 at 06:44 +0000, Behal, Pavel wrote:
> Dear List Members,
> 
> I have found syslog-ng really valuable part of operating system, 
> thanks to all. I would like to ask a flow-control related question:
> 
> I have tried to use it (2.0.5) also as a collector of events from 
> some log text-files using the file source with follow-freq set. 
> It is working fine. But I have realized, that in case of network 
> problem, the syslog-ng process never stops reading the data. 
> (Yes, this is normal.) It continuously follows the incremented 
> data and everything above volume the of internal line buffer get 
> lost. I hoped, this can be changed using the flow-control flag, 
> but I think the flow-control flag does not affect the file source 
> and it never blocks reading.
> 
> Is there any way, how to setup the syslog-ng to stop reading the 
> followed source file when destination is unavailable and continue 
> from last event send after reconnect? Thank you.
> 

Hmm.. if flow-control is enabled, syslog-ng should stop reading data
from all sources that feed data into the flow-controlled path.

Can you post your configuration file?

-- 
Bazsi



More information about the syslog-ng mailing list