[syslog-ng] Odd behavior with very small log_fifo_size()

[Joe Shaw]

Hi,

On Wed, Jul 2, 2008 at 5:13 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:
> syslog-ng does not log message loss on file destinations, because that'd
> clutter the log statistics line, on the asssumption that no messages are
> can be lost there.
>
> However this is not always the case, if you log_fifo_size() is smaller
> than the window size of incoming sources, messages can be lost.

Could something be added if -v were passed to syslog-ng then?  It's
(very) useful diagnostic information when you're tuning an
installation and I probably wouldn't have noticed if not for the data
that loggen outputs and the fact that the log file seemed small.

> Here is a description of how flow-control and window sizes work in
> syslog-ng:
>
> http://www.balabit.hu/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html
>
> Please let me (and the doc team) know if the description could be made
> clearer somehow.

I hadn't seen this before -- I was only using the docs shipped with
the tarball -- and it's good information.

My setting of the log_fifo_size() in testing was for two reasons: (1)
to see how setting it affected memory usage when being hit with many
large messages and (2) to demonstrably see what its behavior was if it
was overloaded and had to drop messages.  I would have liked a little
more info in the latter.

As for the docs, it does mention that without the flow control
messages may be lost, but doesn't indicate how this might be detected
or what happens if they are.

Thanks,
Joe