Andrei Borzenkov wrote:
But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full).
In my case, there's hardly any activity on the system, not to mention the log. Only when cron kicks in and wants to write to the log. It seems highly unlikely that such minimal activity should cause the socket buffer to be full. (unless it is incredibly small perhaps).
In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself.
syslog-ng 3.5.4 on openSUSE 13.2 does not have this support, afaict. Which I guess means using ForwardToSyslog=yes, the default. Never mind, I had a nagging doubt and went through my bugreports this morning - https://bugzilla.opensuse.org/show_bug.cgi?id=922191 I'll install a recent syslog-ng 3.6 on a test system and see what happens. -- Per Jessen, Zürich (0.9°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org