[syslog-ng] Syslog-ng losing messages on solaris 10

Balazs Scheidler bazsi at balabit.hu
Thu Feb 21 16:19:15 CET 2008


On Wed, 2008-02-20 at 18:30 +0100, Balazs Scheidler wrote:
> On Wed, 2008-02-20 at 14:32 +0000, AndyH at nominet.org.uk wrote:
> > When I run the syslogd as supplied with Solaris 10 then all messages get
> > logged, but when I use syslog-ng then it loses messages.  On a Sun V210 I
> > see these messages
> > 
> > message overflow on /dev/log minor #6 -- is syslogd(1M) running?
> > message overflow on /dev/log minor #6 -- is syslogd(1M) running?
> > message overflow on /dev/log minor #6 -- is syslogd(1M) running?
...

> diff --git a/src/afstreams.c b/src/afstreams.c
> index 009b074..d0a76f3 100644
> --- a/src/afstreams.c
> +++ b/src/afstreams.c
> @@ -134,7 +134,7 @@ afstreams_sd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist)
>            close(fd);
>            return FALSE;
>          }
> -      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_NOMREAD | LR_PKTTERM, s, &self->reader_options);
> +      self->reader = log_reader_new(streams_read_new(fd), LR_LOCAL | LR_PKTTERM, s, &self->reader_options);
>        log_pipe_append(self->reader, s);
>        
>        if (self->door_filename)
> 
> This will cause the log-fetch-limit() option to become effective, thus several messages 
> are going to be fetched for every iteration, this can easily multiply performance.
> 
> Please also check if the local messages get mangled in any way, I seriously doubt 
> that would happen, but messing with message transports always carries some risk.
> 

Can you please send feedback on this patch? Thanks.

-- 
Bazsi



More information about the syslog-ng mailing list