[syslog-ng] Problems with syslog-ng

[Evan Rempel]

Sandor Geller wrote:
> Hi,
> 
> On Thu, Sep 3, 2009 at 6:30 AM, Jain, Vaibhav (GE
> Healthcare)<Vaibhav.Jain at ge.com> wrote:
>> Hi,
>>
>> Thanks for your quick response.
>>
>> As per my understaning the buffering facility is only supported in the
>> premium version but I am using the Open source verison that's why I
>> asked these questions.
> 
> syslog-ng OSE has in-memory buffering only. The contents of the
> buffers will get lost when syslog-ng stops or reinitialises itself
> (when receiving a HUP signal for example). In contrast syslog-ng PE
> has persistent on-disk buffering in addition to avoid losing logs.

Can you confirm that a HUP will loose the buffers please? I was under the impression
that a HUP *only* caused syslog-ng to close and reopen its source and destinations.


> 
>> Does syslog-ng open source supports the buffering facility for log
>> messages ? If syslog-ng server is down then does syslog-ng client
>> buffers the log message? What it the maximum limit of buffer size and
>> how to set it in syslog-ng open source configuration file? Is it
>> log_fifo_size() ?
> 
> Yes, it's log_fifo_size. I think only the available physical memory is
> the real limitation here...
> 
>> I am using the following code in logrotate.d file to send the HUP signal
>> to syslog-ng. Let me know this is correct way to send the HUP signal to
>> syslog-ng or not ? Do I need to add any configuration in syslog-ng ? Is
>> there any chance to loss the data?
>>
>> /var/log/*.log {
>>    postrotate
>>        /bin/kill -HUP `cat /var/run/syslogd-ng.pid 2> /dev/null` 2>
>> /dev/null ||
>> true
>>    endscript
>> }
> 
> I'd limit the number of signals sent to syslog-ng to 1. Distros
> usually use a single logrotate file where there are multiple logs
> rotated, and send the HUP signal only when the last log has been
> rotated. I usually add delaycompress to all rotate configs as well to
> avoid silent data loss (which could happen when logrotate compresses
> the logfile but syslog-ng still sends messages to the file which is
> being compressed, there is a race between the two apps).
> 
> Regards,
> 
> Sandor
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 


-- 
Evan Rempel                               erempel at uvic.ca
Senior Programmer Analyst                    250.721.7691
Unix Services, University Systems, University of Victoria