[syslog-ng] lost messages with follow_freq()?

[Joe Shaw]

Hi,

On Thu, Aug 21, 2008 at 8:28 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:
> Hmm.. are you sure that the given file destination is the only one where
> message loss can occur?

Yes, but you were right again.  My problem this time is simply that I
wasn't patient enough.  My tool which replays the logs runs in about
20 minutes but it takes considerably longer for that data to make it
to the centralized server.  This makes sense: with a follow_freq() of
1 and reading up to a 1000 messages from the file, it'll take quite a
while to chew through some of the very long log files.

Thanks for your help with this.  I've attached a patch which enables
the dropped messages counter for destination files if the verbose flag
is set.  I think this would be helpful if you are in a situation like
me and had no idea that messages were being dropped on the destination
file end.

Joe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: syslog-ng-drop-verbose.patch
Type: application/octet-stream
Size: 627 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080821/13fadd46/attachment.obj