[syslog-ng] lost messages with follow_freq()?

[Joe Shaw]

Hi again,

A quick followup to my last post:

On Tue, Aug 19, 2008 at 3:21 PM, Joe Shaw <joe at joeshaw.org> wrote:
> I'm trying to use the follow_freq() option to tail a growing log file,
> but not all of the messages are making it from the source end to the
> destination end.  However, according to the statistics, no messages
> are dropped.  I am using syslog-ng 2.0.9.

I changed follow_freq() in the source to be measured in milliseconds
rather than full seconds and set the frequency to 50ms.  The outcome
is considerably better, but still missing some data:

    [jshaw at source-host /ita]$ wc -l dump-file
    9982973 dump-file

versus:

    [jshaw at dest-host /ita]$ wc -l syslog-messages
    9263853 syslog-messages

syslog-messages is actually bigger than dump-file now, but that's
because of the syslog headers prepended to the lines.  The number of
lines above is still short.

I'll try lowering the interval even further and seeing if it gets closer.

Joe