[syslog-ng] Problems with syslog-ng

[Sandor Geller]

Hi,

On Thu, Sep 3, 2009 at 6:30 AM, Jain, Vaibhav (GE
Healthcare)<Vaibhav.Jain at ge.com> wrote:
> Hi,
>
> Thanks for your quick response.
>
> As per my understaning the buffering facility is only supported in the
> premium version but I am using the Open source verison that's why I
> asked these questions.

syslog-ng OSE has in-memory buffering only. The contents of the
buffers will get lost when syslog-ng stops or reinitialises itself
(when receiving a HUP signal for example). In contrast syslog-ng PE
has persistent on-disk buffering in addition to avoid losing logs.

> Does syslog-ng open source supports the buffering facility for log
> messages ? If syslog-ng server is down then does syslog-ng client
> buffers the log message? What it the maximum limit of buffer size and
> how to set it in syslog-ng open source configuration file? Is it
> log_fifo_size() ?

Yes, it's log_fifo_size. I think only the available physical memory is
the real limitation here...

> I am using the following code in logrotate.d file to send the HUP signal
> to syslog-ng. Let me know this is correct way to send the HUP signal to
> syslog-ng or not ? Do I need to add any configuration in syslog-ng ? Is
> there any chance to loss the data?
>
> /var/log/*.log {
>    postrotate
>        /bin/kill -HUP `cat /var/run/syslogd-ng.pid 2> /dev/null` 2>
> /dev/null ||
> true
>    endscript
> }

I'd limit the number of signals sent to syslog-ng to 1. Distros
usually use a single logrotate file where there are multiple logs
rotated, and send the HUP signal only when the last log has been
rotated. I usually add delaycompress to all rotate configs as well to
avoid silent data loss (which could happen when logrotate compresses
the logfile but syslog-ng still sends messages to the file which is
being compressed, there is a race between the two apps).

Regards,

Sandor