[syslog-ng] v3.3 not flushing lines?

[Clayton Dukes]

3rd try...anyone?

______________________________________________________________

Clayton Dukes
______________________________________________________________


On Thu, Jan 12, 2012 at 3:48 PM, Clayton Dukes <cdukes at gmail.com> wrote:

> Can anyone help here? I'm out of ideas :-)
>
> ______________________________________________________________
>
> Clayton Dukes
> ______________________________________________________________
>
>
>
> On Wed, Jan 11, 2012 at 8:05 PM, Clayton Dukes <cdukes at gmail.com> wrote:
>
>> Hey folks,
>>
>> I have a user experiencing an issue where some of the incoming logs are
>> not getting piped to my perl script until the second time we generate
>> events.
>>
>> I believe this is generally set using flush_lines(1), but it doesn’t seem
>> to be honoring that setting in the config.
>> I also tried adding flush_timeout(900), but that has no affect.
>> In the output below, if I quit the telnet and start it again, the
>> previously missing events are then received (but the current ones are
>> missing) - basically, it doesn't appear to be flushing every single line.
>> Possible other reason: has something changed between v2.x and 3.x where
>> the program() destination would possibly not send an EOF signal - i.e. is
>> the pipe now kept open vs. an individual call to the program each time in
>> v2.x?
>>
>>
>> To verify that this is happening:
>>
>>
>> Term 1:
>> tail -f /tmp/logzilla_import.txt
>> Term 2:
>> /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -Fdv
>> Term 3:
>> telnet 192.168.254.1
>>
>> Term 1 results:
>> 192.168.254.1     22      7       3732620769      .Jan 11 2012
>> 19:29:02.284 EST: Telnet2: 1 1 251 1       3751981041      0       2012-01-11
>> 19:29:02 2012-01-11 19:29:02
>> 192.168.254.1     22      7       3732620769      .Jan 11 2012
>> 19:29:02.284 EST: TCP2: Telnet sent WILL ECHO (1)  3751981041      0  2012-01-11
>> 19:29:02      2012-01-11 19:29:02
>>
>> Term 2 results:
>> Incoming log entry; line='<183>6987: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet sent WILL ECHO (1)'
>> Incoming log entry; line='<183>6988: .Jan 11 2012 19:29:02.284 EST:
>> Telnet2: 2 2 251 3'
>> Incoming log entry; line='<183>6989: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet sent WILL SUPPRESS-GA (3)'
>> Incoming log entry; line='<183>6990: .Jan 11 2012 19:29:02.284 EST:
>> Telnet2: 80000 80000 253 24'
>> Incoming log entry; line='<183>6991: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet sent DO TTY-TYPE (24)'
>> Incoming log entry; line='<183>6992: .Jan 11 2012 19:29:02.284 EST:
>> Telnet2: 10000000 10000000 253 31'
>> Incoming log entry; line='<183>6993: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet sent DO WINDOW-SIZE (31)'
>> Incoming log entry; line='<183>6994: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet received DO ENCRYPTION (38)'
>> Incoming log entry; line='<183>6995: .Jan 11 2012 19:29:02.284 EST: TCP2:
>> Telnet sent WONT ENCRYPTION (38) (unimplemented)'
>> Incoming log entry; line='<183>6996: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL ENCRYPTION (38)'
>> Incoming log entry; line='<183>6997: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent DONT ENCRYPTION (38) (unimplemented)'
>> Incoming log entry; line='<183>6998: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received DO SUPPRESS-GA (3)'
>> Incoming log entry; line='<183>6999: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL TTY-TYPE (24)'
>> Incoming log entry; line='<183>7000: .Jan 11 2012 19:29:02.292 EST:
>> Telnet2: Sent SB 24 1 '
>> Incoming log entry; line='<183>7001: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL WINDOW-SIZE (31)'
>> Incoming log entry; line='<183>7002: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL TTY-SPEED (32) (refused)'
>> Incoming log entry; line='<183>7003: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent DONT TTY-SPEED (32)'
>> Incoming log entry; line='<183>7004: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL LOCAL-FLOW (33) (refused)'
>> Incoming log entry; line='<183>7005: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent DONT LOCAL-FLOW (33)'
>> Incoming log entry; line='<183>7006: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL LINEMODE (34)'
>> Incoming log entry; line='<183>7007: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent DONT LINEMODE (34) (unimplemented)'
>> Incoming log entry; line='<183>7008: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received WILL NEW-ENVIRON (39)'
>> Incoming log entry; line='<183>7009: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent DONT NEW-ENVIRON (39) (unimplemented)'
>> Incoming log entry; line='<183>7010: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received DO STATUS (5)'
>> Incoming log entry; line='<183>7011: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet sent WONT STATUS (5) (unimplemented)'
>> Incoming log entry; line='<183>7012: .Jan 11 2012 19:29:02.292 EST: TCP2:
>> Telnet received DO ECHO (1)'
>> Incoming log entry; line='<183>7013: .Jan 11 2012 19:29:02.292 EST:
>> Telnet2: recv SB NAWS 132 63'
>> Incoming log entry; line='<183>7014: .Jan 11 2012 19:29:02.292 EST:
>> Telnet2: recv SB 24 0 LINUX'
>> Incoming log entry; line='<183>7015: .Jan 11 2012 19:29:02.493 EST: TCP2:
>> Telnet received WILL ENVIRONMENT (36) (refused)'
>> Incoming log entry; line='<183>7016: .Jan 11 2012 19:29:02.493 EST: TCP2:
>> Telnet sent DONT ENVIRONMENT (36)'
>>
>>
>>
>>
>>
>>
>> ______________________________________________________________
>>
>> Clayton Dukes
>> ______________________________________________________________
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120113/6dff4dfe/attachment.htm