[syslog-ng] syslog-ng 2.0.8 dropped messages - totally confused
Balazs Scheidler
bazsi at balabit.hu
Thu Mar 27 10:41:48 CET 2008
On Wed, 2008-03-26 at 09:46 -0700, Evan Rempel wrote:
> Another instance of dropped messages, but all statics records from syslog-ng indicate that no messages were dropped.
>
> Here is the logging path
>
>
> Server C - syslog-ng 2.0.8
> - file destination
> - tcp destination A
> - tcp destination B
>
> Server A - syslog-ng 2.0.8 Linux 2.6.x
> - tcp source
> - pipe destination
> Server A - syslog-ng 2.0.8 linux 2.6.x
> - pipe source with flow-control
> - file destination
>
> Server B - syslog-ng 2.0.8 Linux 2.6.x
> - tcp source
> - pipe destination
> Server B - syslog-ng 2.0.8 linux 2.6.x
> - pipe source with flow-control
> - file destination
>
>
> Server C logged 608955 messages
> Server A logged 351502 messages
> Server B logged 179874 messages
>
> None of the servers record any dropped messages.
> syslog-ng does not report dropped messages on file destinations, but with the flow-control
> any drops should occur at the server that writes to the pipe.
>
> Anyone want to propose an explanation?
Isn't this the same as the previous one? E.g. the tcp connections could
not be established at startup from Server C -> Server A and Server C ->
Server B
Otherwise I can't see where it could lose messages, it should at least
report it. I'm going to add a "global" drop counter, just as in 1.6.x;
it might give a clue in these situations.
--
Bazsi
More information about the syslog-ng
mailing list