[syslog-ng] lost messages with follow_freq()?

[Balazs Scheidler]

On Tue, 2008-08-19 at 16:02 -0400, Joe Shaw wrote:
> Hi again,
> 
> A quick followup to my last post:
> 
> On Tue, Aug 19, 2008 at 3:21 PM, Joe Shaw <joe at joeshaw.org> wrote:
> > I'm trying to use the follow_freq() option to tail a growing log file,
> > but not all of the messages are making it from the source end to the
> > destination end.  However, according to the statistics, no messages
> > are dropped.  I am using syslog-ng 2.0.9.
> 
> I changed follow_freq() in the source to be measured in milliseconds
> rather than full seconds and set the frequency to 50ms.  The outcome
> is considerably better, but still missing some data:
> 
>     [jshaw at source-host /ita]$ wc -l dump-file
>     9982973 dump-file
> 
> versus:
> 
>     [jshaw at dest-host /ita]$ wc -l syslog-messages
>     9263853 syslog-messages
> 
> syslog-messages is actually bigger than dump-file now, but that's
> because of the syslog headers prepended to the lines.  The number of
> lines above is still short.
> 
> I'll try lowering the interval even further and seeing if it gets closer.

The problem is probably related to the fifo size on the destination
file. file related statistics are not reported (as they'd clutter the
log statistics message).

so please increase log_fifo_size() on your destination file.

-- 
Bazsi