[syslog-ng] message loss using multi-line-mode

[Laszlo Budai]

Hi,

opening a new issue is not necessary.
I hope that a GSoC student will solve this issue.

BTW GSoC: we are still looking for feature owners to our GSoC[1] projects[2]. As an experienced syslog-ng user you could join to us. What do you think?

[1] https://syslog-ng.org/gsoc-2016/
[2] https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html

regards,
Laszlo Budai

Sent from my HTC

----- Reply message -----
From: "Patrick Hemmer" <syslogng at stormcloud9.net>
To: "Syslog-ng users' and developers' mailing list" <syslog-ng at lists.balabit.hu>
Subject: [syslog-ng] message loss using multi-line-mode
Date: Tue, May 17, 2016 00:17


Anybody? Should I open a new issue?

-Patrick

On 2016/3/28 12:01, Patrick Hemmer wrote:
> I raised issue on an existing bug on the github tracker, but it seems
> to have gone unnoticed, so I'm repeating it here to try and get some
> attention on the issue.
>
> Using multi-line-mode without the multi-line-suffix option WILL result
> in message loss.
> When syslog-ng is running in multi-line-mode, it buffers multi-line
> messages until it sees the start of a new message. When it sees the
> start of a new message, it flushes the buffered message, and puts the
> first line of the new message in the buffer. However if syslog-ng
> shuts down, or receives a SIGHUP (reload), any lines currently
> buffered are discarded. Given that syslog-ng can't stay running
> forever, and it will get shut down or SIGHUPd eventually, using this
> feature will result in messages getting lost.
>
> The message on the github issue where I brought this up is:
> https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887
>
> -Patrick
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160518/af027669/attachment.htm 
-------------- next part --------------
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq