[syslog-ng] v3.3 not flushing lines?

[Clayton Dukes]

Hey folks,

I have a user experiencing an issue where some of the incoming logs are not
getting piped to my perl script until the second time we generate events.

I believe this is generally set using flush_lines(1), but it doesn’t seem
to be honoring that setting in the config.
I also tried adding flush_timeout(900), but that has no affect.
In the output below, if I quit the telnet and start it again, the
previously missing events are then received (but the current ones are
missing) - basically, it doesn't appear to be flushing every single line.
Possible other reason: has something changed between v2.x and 3.x where the
program() destination would possibly not send an EOF signal - i.e. is the
pipe now kept open vs. an individual call to the program each time in v2.x?


To verify that this is happening:


Term 1:
tail -f /tmp/logzilla_import.txt
Term 2:
/usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -Fdv
Term 3:
telnet 192.168.254.1

Term 1 results:
192.168.254.1     22      7       3732620769      .Jan 11 2012 19:29:02.284
EST: Telnet2: 1 1 251 1       3751981041      0       2012-01-11
19:29:02 2012-01-11
19:29:02
192.168.254.1     22      7       3732620769      .Jan 11 2012 19:29:02.284
EST: TCP2: Telnet sent WILL ECHO (1)  3751981041      0  2012-01-11 19:29:02
     2012-01-11 19:29:02

Term 2 results:
Incoming log entry; line='<183>6987: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet sent WILL ECHO (1)'
Incoming log entry; line='<183>6988: .Jan 11 2012 19:29:02.284 EST:
Telnet2: 2 2 251 3'
Incoming log entry; line='<183>6989: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet sent WILL SUPPRESS-GA (3)'
Incoming log entry; line='<183>6990: .Jan 11 2012 19:29:02.284 EST:
Telnet2: 80000 80000 253 24'
Incoming log entry; line='<183>6991: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet sent DO TTY-TYPE (24)'
Incoming log entry; line='<183>6992: .Jan 11 2012 19:29:02.284 EST:
Telnet2: 10000000 10000000 253 31'
Incoming log entry; line='<183>6993: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet sent DO WINDOW-SIZE (31)'
Incoming log entry; line='<183>6994: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet received DO ENCRYPTION (38)'
Incoming log entry; line='<183>6995: .Jan 11 2012 19:29:02.284 EST: TCP2:
Telnet sent WONT ENCRYPTION (38) (unimplemented)'
Incoming log entry; line='<183>6996: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL ENCRYPTION (38)'
Incoming log entry; line='<183>6997: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent DONT ENCRYPTION (38) (unimplemented)'
Incoming log entry; line='<183>6998: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received DO SUPPRESS-GA (3)'
Incoming log entry; line='<183>6999: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL TTY-TYPE (24)'
Incoming log entry; line='<183>7000: .Jan 11 2012 19:29:02.292 EST:
Telnet2: Sent SB 24 1 '
Incoming log entry; line='<183>7001: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL WINDOW-SIZE (31)'
Incoming log entry; line='<183>7002: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL TTY-SPEED (32) (refused)'
Incoming log entry; line='<183>7003: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent DONT TTY-SPEED (32)'
Incoming log entry; line='<183>7004: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL LOCAL-FLOW (33) (refused)'
Incoming log entry; line='<183>7005: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent DONT LOCAL-FLOW (33)'
Incoming log entry; line='<183>7006: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL LINEMODE (34)'
Incoming log entry; line='<183>7007: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent DONT LINEMODE (34) (unimplemented)'
Incoming log entry; line='<183>7008: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received WILL NEW-ENVIRON (39)'
Incoming log entry; line='<183>7009: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent DONT NEW-ENVIRON (39) (unimplemented)'
Incoming log entry; line='<183>7010: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received DO STATUS (5)'
Incoming log entry; line='<183>7011: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet sent WONT STATUS (5) (unimplemented)'
Incoming log entry; line='<183>7012: .Jan 11 2012 19:29:02.292 EST: TCP2:
Telnet received DO ECHO (1)'
Incoming log entry; line='<183>7013: .Jan 11 2012 19:29:02.292 EST:
Telnet2: recv SB NAWS 132 63'
Incoming log entry; line='<183>7014: .Jan 11 2012 19:29:02.292 EST:
Telnet2: recv SB 24 0 LINUX'
Incoming log entry; line='<183>7015: .Jan 11 2012 19:29:02.493 EST: TCP2:
Telnet received WILL ENVIRONMENT (36) (refused)'
Incoming log entry; line='<183>7016: .Jan 11 2012 19:29:02.493 EST: TCP2:
Telnet sent DONT ENVIRONMENT (36)'






______________________________________________________________

Clayton Dukes
______________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120111/b174f847/attachment.htm