[syslog-ng] message loss using multi-line-mode

[Noémi Ványi]

Hello!

In a few weeks my university tasks will be done. After that I would like to
take a look at the problem and if I can fix it, I will do it. :)

Also, it would be great if you could be the feature owner of my project! My
project is the syslog-ng as a command line tool. It could help you to test
syslog-ng configuration for example. :)

Regards,
kvch

On 19 May 2016 at 06:20, Laszlo Budai <laszlo.budai at outlook.com> wrote:

> Hi,
>
> opening a new issue is not necessary.
> I hope that a GSoC student will solve this issue.
>
> BTW GSoC: we are still looking for feature owners to our GSoC[1] projects[2].
> As an experienced syslog-ng user you could join to us. What do you think?
>
> [1] https://syslog-ng.org/gsoc-2016/
> [2] https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html
>
> regards,
> Laszlo Budai
>
> Sent from my HTC
>
> ----- Reply message -----
> From: "Patrick Hemmer" <syslogng at stormcloud9.net>
> To: "Syslog-ng users' and developers' mailing list" <
> syslog-ng at lists.balabit.hu>
> Subject: [syslog-ng] message loss using multi-line-mode
> Date: Tue, May 17, 2016 00:17
>
> Anybody? Should I open a new issue?
>
> -Patrick
>
> On 2016/3/28 12:01, Patrick Hemmer wrote:
>
> I raised issue on an existing bug on the github tracker, but it seems to
> have gone unnoticed, so I'm repeating it here to try and get some attention
> on the issue.
>
> Using multi-line-mode without the multi-line-suffix option WILL result in
> message loss.
> When syslog-ng is running in multi-line-mode, it buffers multi-line
> messages until it sees the start of a new message. When it sees the start
> of a new message, it flushes the buffered message, and puts the first line
> of the new message in the buffer. However if syslog-ng shuts down, or
> receives a SIGHUP (reload), any lines currently buffered are discarded.
> Given that syslog-ng can't stay running forever, and it will get shut down
> or SIGHUPd eventually, using this feature will result in messages getting
> lost.
>
> The message on the github issue where I brought this up is:
> <https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887>
> https://github.com/balabit/syslog-ng/issues/140#issuecomment-197673887
>
> -Patrick
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160519/638ff6f5/attachment.htm