[syslog-ng] lost messages with follow_freq()?

[Joe Shaw]

Hi again,

On Wed, Aug 20, 2008 at 12:39 PM, Balazs Scheidler <bazsi at balabit.hu> wrote:
> The problem is probably related to the fifo size on the destination
> file. file related statistics are not reported (as they'd clutter the
> log statistics message).
>
> so please increase log_fifo_size() on your destination file.

You were right, I was dropping messages on the destination side and
increasing the log_fifo_size() there stopped the "dropped messages"
warnings.  However, it didn't solve the problem.  The file on the
destination size is still considerably smaller, and it doesn't explain
why making the follow_freq() window smaller (from 1s to 50ms) improves
the results considerably.

Thanks,
Joe