[syslog-ng] message loss using multi-line-mode

[Laszlo Budai]

Hi,

it is an ideal topic for GSoC students during community bonding period (or those who want to participate in GSoC in the future). Any volunteer?

L.

Sent from my HTC

----- Reply message -----
From: syslogng at stormcloud9.net
To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>
Subject: [syslog-ng] message loss using multi-line-mode
Date: Wed, May 18, 2016 15:58


That was my original intent (to write a patch), but after looking at the
code, I didn't think it would be a good idea (I used to code against
syslog-ng back in the around the 3.1 days, but it appears the code has
gotten significantly more complex).

Given that there is message loss involved here, I just thought it might
raise the priority of the issue.

-Patrick


On 2016/5/17 08:47, Scheidler, Balázs wrote:
> hi,
>
> I don't think that would help, sorry. Everyone is working on other
> stuff as it seems. Would you try to cook up a patch? I know it might
> intimidating at first, but you know it's all just code and computers
> :) not more complicated than a shell script. *
>
> [*] ok, a bit more complicated, but everyone has to start somewhere :)
>
>
> --
> Bazsi
>
> On Tue, May 17, 2016 at 12:16 AM, Patrick Hemmer
> <syslogng at stormcloud9.net <mailto:syslogng at stormcloud9.net>> wrote:
>
>     Anybody? Should I open a new issue?
>
>     -Patrick
>
>
>     On 2016/3/28 12:01, Patrick Hemmer wrote:
>>     I raised issue on an existing bug on the github tracker, but it
>>     seems to have gone unnoticed, so I'm repeating it here to try and
>>     get some attention on the issue.
>>
>>     Using multi-line-mode without the multi-line-suffix option WILL
>>     result in message loss.
>>     When syslog-ng is running in multi-line-mode, it buffers
>>     multi-line messages until it sees the start of a new message.
>>     When it sees the start of a new message, it flushes the buffered
>>     message, and puts the first line of the new message in the
>>     buffer. However if syslog-ng shuts down, or receives a SIGHUP
>>     (reload), any lines currently buffered are discarded. Given that
>>     syslog-ng can't stay running forever, and it will get shut down
>>     or SIGHUPd eventually, using this feature will result in messages
>>     getting lost.
>>
>>     The message on the github issue where I brought this up is:
>>     https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887
>>
>>     -Patrick
>>
>>
>>     ______________________________________________________________________________
>>     Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>     Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
>>     FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>
>
>     ______________________________________________________________________________
>     Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>     Documentation:
>     http://www.balabit.com/support/documentation/?product=syslog-ng
>     FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160518/74cce053/attachment.htm 
-------------- next part --------------
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq