[syslog-ng] program destination application status

[Jain, Vaibhav (GE Healthcare)]

Hi Marton,

Thanks for your quick response.

If program stops reading the message from stdin for some time, then in
that time, will program lose the log message from syslog-ng ? Or syslog
will starts feeding the logs from next to the last log mesg sent to
program.

If my program is slower than incoming freq of syslog-ng logs then in
that case will program lose the log mesgs from syslog-ng? 

If syslog-ng stops reading logs from its source for some time then in
that case will syslog-ng lose the mesg from source ?  If source is tcp
port.

Note: I am using open source version of syslog-ng (3.0.3-1 On rhel5)

Thanks,
-V
 

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of ILLES, Marton
Sent: Wednesday, August 26, 2009 3:09 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] program destination application status

On Wed, 2009-08-26 at 13:30 +0530, Jain, Vaibhav (GE Healthcare) wrote:
> Hi,
> 
> I am using syslog-ng open source 3.0.3-1 ( rhel5.amd64) version. I am 
> sending my log messages to a python parser(in program destination) to 
> do some action on log messages.I want to know if my program 
> application is down then can I know it in syslog-ng configuration? 
> Because if my parser application is down then in that case I want to 
> stop sending message to parser code because it's down, otherwise I
will lose my log messages.
> And once the application comes up then I want to send the log
messages.

syslog-ng starts the specified program and feeds it with log messages.
When you script/program dies/exists syslog-ng detects it and tries to
restart it. This way the program is always available to receive
messages.
If your program feeds the messages to any further application than it
must take care of buffering the data, or stop reading from it's stdin,
so syslog-ng can not feed it with logs. If you use flow-control in log
statements than syslog-ng would also stop reading from it's log sources.

M


> 
> 
> 
> # destinations
> destination d_parser {
> #Send message to parser
> program("python /opt/syslog-ng/etc/Parser.py"); };
> 
> 
> log {
> source(s_network);
> destination(d_parser);
> };
> 
> Regards,
> Vaibhav
> ______________________________________________________________________
> ________ Member info: 
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: 
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
> 
--
Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

________________________________________________________________________
______
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html