[syslog-ng] Transmitting a Huge Log File

[Sandor Geller]

Hi,

On Wed, Mar 9, 2011 at 2:50 PM, Hidayath Basha
<hidayath.basha at saventech.com> wrote:
> Hi all,
>
> I'm trying to transmit a huge log file (of about 80k lines) to a centralized
> syslog server over TCP

80k lines is piece of cake unless the average line length is quite big :)

> But, on the syslog server, I'm receiver only the last part of the log file
> (of about 7000 lines)
>
> How can I transmit the whole log file

syslog-ng keeps track where it left off reading a file to avoid
sending the whole file again when it gets restarted so my guess is
that you fired up syslog-ng a few times.

To confirm this could you stop syslog-ng, delete
/var/lib/syslog-ng.persist (or where your persist file lives) and
start syslog-ng?

If the problem persists then run syslog-ng under strace and show the
relevant parts (file opens, seeks, reads).

Regards,

Sandor