[syslog-ng] syslog-ng does not start if destination host not found

[Bendler, Ehren]

In syslog-ng 3.5.4.1, this seems to be a recurrence of an issue that has appeared several times before over the years, most recently said to be fixed/changed in v3.3.5 here (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660897). We had previously been using syslog-ng 3.0.4, which would fail this test gracefully and retry the connection based on the time_reopen() parameter.

We don't use DNS, but we generate a hard-coded /etc/hosts file after startup that associates internal names with a customer chosen subnet address so that we can collect logs without editing the syslog-ng.conf file while we are running.  As in, we know that the primary controller will always be present with the name "CTXP", but we can't promise that it will have a particular address because the customer can change it, so we have to write it out to /etc/hosts at a point in the startup process *after* syslog-ng is started.

  * Starting syslog-ng                      
 Error resolving hostname; host='CTXP' 
 Error initializing message pipeline;
..[FAIL(2)]

If this is the intended behavior, that's fine too. We can deploy our own patch to the afsocket module if it isn't going to be changed in a release.


Another thing I need help with (when I use a hard-coded IP in syslog-ng.conf for testing) is how to get this message to go away:
  * Starting syslog-ng                      
 WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to 100 entries. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='10', new_log_iw_size='100', min_log_fifo_size='12000'
[OK]

Here are the settings we have for these parameters:

source remote_lms {
  syslog(ip(0.0.0.0) port(5149) max-connections(120) log_iw_size(1200) so_keepalive(yes));
};

With log_fifo_size(12000) set in the global options. The documentation says I did the math correctly here, with log_fifo_size = 10 * log_iw_size(), and log_iw_size() = 10 * max-connections()? This is the only remote source in our configuration.

Thanks,
Ehren Bendler