[syslog-ng] Problem with getting syslog-ng statistics

[Aleksei Plotnikov]

On Mon, 24 Jan 2011 18:29:19 +0200, Balazs Scheidler <bazsi at balabit.hu>  
wrote:

> On Mon, 2011-01-24 at 11:50 +0200, Aleksei Plotnikov wrote:
>> Hello everyone,
>>
>> I have a problem with getting statistics from syslog-ng 3.0.5 (under
>> Debian 5.0.4) using it's socket file.
>>
>> In our configuration logs received by syslog-ng are being forwarded to
>> python scripts (which in turn send logs to database). Since sometimes
>> these scripts cannot handle the load, we want to monitor syslog-ng
>> statistics for dropped logs. Currently, I run a script from cron which
>> get statistics from syslog-ng socket file like this "echo STATS |
>> socat - /var/lib/syslog-ng/syslog-ng.ctl" and then parse output. Most
>> of time it works great, but during peak times when number of logs get
>> higher ( ~2000 logs/sec instead of ~1500 logs/sec), this cron script
>> cannot get any output from statistics. Also this message appears
>> in /var/log/syslog:
>> syslog-ng[21677]: Error writing control channel; error='Broken pipe
>> (32)'
>>
>> Is it possible to tune syslog-ng statistics somehow, or maybe there is
>> a better way to get statistics?
>
> Hmm. broken pipe seems to indicate that your script exited before
> syslog-ng could actually write all the statistics output to it.
>
> e.g. please check if your script actually reads the complete output
> before exiting.
>
>

That's right, problem was caused by socat, which was closing the pipe  
before syslog-ng could generate/send statistics output. Socat (netcat  
analog) has default timeout for inactivity 0,5 seconds and it seems that  
syslog-ng was not able to respond that fast when under higher load. After  
increasing socat timeout problem disappeared.

Thanks for help!

Aleksei