[syslog-ng] Drops?

Mike Rykowski rykowski at northwestern.edu
Wed Jan 14 16:39:46 CET 2009


I configured syslog-ng to pass messages to SEC via named pipes. When I
did I saw in the log statistics:

Jan 13 09:10:00  syslog-ng[13736]: Log statistics; dropped='pipe(sec-
pipe)=1607', dropped='unix-dgram(AF_UNIX(/dev/log))=0',
processed='center(queued)=1794661', processed='center
(received)=1718990',

I then called SEC using the 'program' option instead of named pipes and
I got:

Jan 13 10:14:13 syslog-ng[14031]: Log statistics; dropped='program
(/usr/local/bin/sec.pl -input="-" -conf=/usr/local/etc/my-sec.conf)=0',
dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center
(queued)=2552863', processed='center(received)=2447130',

The drops were zero but the queued and received were not equal. Does
this mean messages are getting dropped?

When I don't call SEC at all I get queued and received to be equal:

Jan 14 09:26:44 syslog-ng[14119]: Log statistics; dropped='unix-dgram
(AF_UNIX(/dev/log))=0', processed='center(queued)=70516726',
processed='center(received)=70516726',
-- 
Mike Rykowski
NU-IT Telecommunications and Network Services



More information about the syslog-ng mailing list