[syslog-ng] syslog-ng 2.0.8 dropped messages - totally confused

Balazs Scheidler bazsi at balabit.hu
Thu Mar 27 10:41:48 CET 2008


On Wed, 2008-03-26 at 09:46 -0700, Evan Rempel wrote:
> Another instance of dropped messages, but all statics records from syslog-ng indicate that no messages were dropped.
> 
> Here is the logging path
> 
> 
> Server C - syslog-ng 2.0.8
> 	- file destination
> 	- tcp destination A
> 	- tcp destination B
> 
> Server A - syslog-ng 2.0.8 Linux 2.6.x
> 	- tcp source
> 	- pipe destination
> Server A - syslog-ng 2.0.8 linux 2.6.x
> 	- pipe source with flow-control
> 	- file destination
> 
> Server B - syslog-ng 2.0.8 Linux 2.6.x
> 	- tcp source
> 	- pipe destination
> Server B - syslog-ng 2.0.8 linux 2.6.x
> 	- pipe source with flow-control
> 	- file destination
> 
> 
> Server C logged 608955 messages
> Server A logged 351502 messages
> Server B logged 179874 messages
> 
> None of the servers record any dropped messages.
> syslog-ng does not report dropped messages on file destinations, but with the flow-control
> any drops should occur at the server that writes to the pipe.
> 
> Anyone want to propose an explanation?

Isn't this the same as the previous one? E.g. the tcp connections could
not be established at startup from Server C -> Server A and Server C ->
Server B

Otherwise I can't see where it could lose messages, it should at least
report it. I'm going to add a "global" drop counter, just as in 1.6.x;
it might give a clue in these situations.

-- 
Bazsi



More information about the syslog-ng mailing list