[syslog-ng] Transmitting a Huge Log File

[Zoltán Pallagi]

Hi,

If the problem is permanent after using Sandor solution as well, maybe 
you should use flow-control in server, because it can happen that the 
client syslog-ng will forward the logs as fast as it can, but the server 
will drop the incoming lines if it cannot process them in time and all 
buffers are full.

Use this config:

log {
source(s_mysrc);
filter(f_filter);
flags(flow-control);
destination(d_mydest);
};


On 2011-03-09 15:49, Sandor Geller wrote:
> Hi,
>
> On Wed, Mar 9, 2011 at 2:50 PM, Hidayath Basha
> <hidayath.basha at saventech.com>  wrote:
>> Hi all,
>>
>> I'm trying to transmit a huge log file (of about 80k lines) to a centralized
>> syslog server over TCP
> 80k lines is piece of cake unless the average line length is quite big :)
>
>> But, on the syslog server, I'm receiver only the last part of the log file
>> (of about 7000 lines)
>>
>> How can I transmit the whole log file
> syslog-ng keeps track where it left off reading a file to avoid
> sending the whole file again when it gets restarted so my guess is
> that you fired up syslog-ng a few times.
>
> To confirm this could you stop syslog-ng, delete
> /var/lib/syslog-ng.persist (or where your persist file lives) and
> start syslog-ng?
>
> If the problem persists then run syslog-ng under strace and show the
> relevant parts (file opens, seeks, reads).
>
> Regards,
>
> Sandor
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110309/73efd98b/attachment.htm