[syslog-ng] Missing messages

[Klimek, Bryan J.]

First time poster, so be gentle.

We run syslog-ng in our environment as a centralized syslog manager for the archiving of syslog data. We have over 2000+ Unix/Linux systems sending their syslog data with a daily ingest rate of about 10GB per day.

It was recently pointed out to me that one particular message from one specific host is not getting persisted to the files on our syslog-ng server all the time. That is to say, it is intermittent.

If one person can find one message that is not making into our syslog-ng archive, I can only assume that we are dropping other messages as well.

How can I debug if and when messages are being lost and not making into the files on my centralized syslog server?

Bryan Klimek
Mayo Clinic

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190624/f64994d1/attachment.html>