[syslog-ng] multiple file sources, worked - some have now gone silent

[Declan White]

On Fri, Feb 16, 2018 at 01:28:02PM +0100, Balazs Scheidler wrote:
> Hi Declan,
> 
> On Thu, Feb 15, 2018 at 6:13 PM, Declan White <declanw at is.bbc.co.uk> wrote:
> 
> I understand the sentiment and rest assured what you described is not an
> intended behaviour.
> 
> Frankly, you are not very helpful here. It is an integral part of open
> source that users are also contributors and help forming the product and/or
> fix bugs. By asserting that there's a problem on your side, without
> providing details to help us fix it, and then calling it a deal breaker
> will not solve the issue.

And I understand that sentiment :) But when I found it had silently broken doing something simple, my priority switched from tracing it/helping you fix it, to running away screaming. I am in survival mode now.

I spent a month of late nights trying to get rsyslog to work. When it vomited thready madness I wisely ran away screaming.

I spent the next month of late nights trying to get syslog-ng working (and patching each of the dependancies that themselves didn't compile, and then compiling GCC itself when I found you were serious about being GCC-only). 
It then silently broke when the receiver blipped, and complained about dropping messages, just shoveling only basic files, in reliable mode, on default settings.

Such an obvious breakage in such an obvious usage case almost certainly means it doesn't do this on Linux or your other test platforms, and that means it will take you a long time to find out what it is about my build/env/OSver/threadmodel that is triggering this. And that's assuming anyone still cares about Sol10.

That would take me some time working with you to find. I do not have that time. I have negative time. I am shedding tears of hysterical laughter and coding a new file relay protocol in perl right now, doing daily status reports to higherups about the huge delays making a simple reliable file relay.

> The premium edition may or may not be for you, but there you could at least
> have some expectations wrt. deal breakers and stuff, as you would be paying
> money in exchange for service and product. And I am not saying that we
> leave the open source as garbage. We do everything to keep it as stable and
> featureful as possible.

Yes, I dangled that options at the higher ups. I'm desperate for a reliable relay protocol (hence the attempt at rsyslog).
But seeing as I can't guarantee syslog-ng will relay UNTRUSTED application logs in a verbatim-recoverable manner (e.g. NUL chars, logs with no newlines), I would eventually have to move away from syslog-ng anyway.

The stars are not aligned. The stars are in fact on fire.

> Cheers,
> -- 
> Bazsi

> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-- 
Declan White