[opensuse] sistemad-journal[359]: Forwarding to syslog missed 2 messages.
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever. -- Per Jessen, Zürich (3.6°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Per Jessen <per@computer.org> writes: Hi Per:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
Interesting, what is missing? Maybe you have services not configured for syslog-ng? I have journald storage completely disabled, so I haven't noticed anything. However, I use rsyslog, so YMMV. Regards, Charles -- ..you could spend *all day* customizing the title bar. Believe me. I speak from experience." (By Matt Welsh)
Charles Philip Chan wrote:
Per Jessen <per@computer.org> writes:
Hi Per:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
Interesting, what is missing?
I don't know - I accidentally came across the warnings when I was reviewing the journal.
Maybe you have services not configured for syslog-ng?
I'm not sure I understand - syslog-ng is running.
I have journald storage completely disabled, so I haven't noticed anything. However, I use rsyslog, so YMMV.
They almost certainly use the same interface, so that should not make much of a difference. What I'd like to understand is still - why is the forwarding to syslog missing some messages?? -- Per Jessen, Zürich (4.6°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Per Jessen <per@computer.org> writes: Hi Per:
I don't know - I accidentally came across the warnings when I was reviewing the journal.
If you ever find out, please do a posting. I would like to know.
Maybe you have services not configured for syslog-ng?
I'm not sure I understand - syslog-ng is running.
Sorry, please disregard this- wrote it not long after I awoke. Of course anything now expressly configure should just go to /var/log/messages. Haven't have to manually touch my rsyslog config in years. Charles -- "Are [Linux users] lemmings collectively jumping off of the cliff of reliable, well-engineered commercial software?" (By Matt Welsh)
Charles Philip Chan wrote:
Per Jessen <per@computer.org> writes:
Hi Per:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
Interesting, what is missing?
I don't know - I accidentally came across the warnings when I was reviewing the journal.
Maybe you have services not configured for syslog-ng?
I'm not sure I understand - syslog-ng is running.
I have journald storage completely disabled, so I haven't noticed anything. However, I use rsyslog, so YMMV.
They almost certainly use the same interface, so that should not make much of a difference.
What I'd like to understand is still - why is the forwarding to syslog missing some messages?? Are you using the version of syslog that extracts the journal data or are you still using systemd forwarding? I have no idea what the solution to the
On Monday, 7 March 2016 13:58:56 GMT Per Jessen wrote: problem is but i was wondering which version of syslog is being installed. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
ianseeks wrote:
On Monday, 7 March 2016 13:58:56 GMT Per Jessen wrote:
What I'd like to understand is still - why is the forwarding to syslog missing some messages??
Are you using the version of syslog that extracts the journal data or are you still using systemd forwarding? I have no idea what the solution to the problem is but i was wondering which version of syslog is being installed.
Ian, that's a good question, I have also been wondering if the syslog-ng on those systems is backlevel. a) opensuse 12.3, systemd 195, syslog-ng 3.4.5. No "missed" messages. b) opensuse leap42, systemd 210, syslog-ng 3.7.1, no "missed" messages. c) opensuse 13.1, systemd 208, syslog-ng 3.4.7, no "missed" messages. d) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2-3 messages missed every 5 minutes. e) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2 messages every 15minutes, followed by 34-37 ditto. Very weird. Looks like it might cron related - in (d), there's a cron-job running every 5 minutes, on (e) there's a cron-job running every 15 minutes. -- Per Jessen, Zürich (3.9°C) http://www.dns24.ch/ - your free DNS host, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On Mon, 7 Mar 2016 18:36, Per Jessen wrote:
ianseeks wrote:
On Monday, 7 March 2016 13:58:56 GMT Per Jessen wrote:
What I'd like to understand is still - why is the forwarding to syslog missing some messages??
Are you using the version of syslog that extracts the journal data or are you still using systemd forwarding? I have no idea what the solution to the problem is but i was wondering which version of syslog is being installed.
Ian, that's a good question, I have also been wondering if the syslog-ng on those systems is backlevel.
a) opensuse 12.3, systemd 195, syslog-ng 3.4.5. No "missed" messages. b) opensuse leap42, systemd 210, syslog-ng 3.7.1, no "missed" messages. c) opensuse 13.1, systemd 208, syslog-ng 3.4.7, no "missed" messages. d) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2-3 messages missed every 5 minutes. e) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2 messages every 15minutes, followed by 34-37 ditto. Very weird.
Looks like it might cron related - in (d), there's a cron-job running every 5 minutes, on (e) there's a cron-job running every 15 minutes.
Hmm, is the (d) + (e) system a upgraded system from a prior (e.g. 13.1) release? b/c from 208 to 210 some of the defaults for journald have changed. On my Fresh install of Leap42.1 (systemd 210) (rsyslog 8.4.0), I had to set some opts to get to the 'No "missed" messages' state: file /etc/systemd/journald.conf, diff -U0 style --- Default (or if unset, according to Docu) +++ MySetting: @@ - #SyncIntervalSec=5m + SyncIntervalSec=1m @@ - #RateLimitBurst=1000 + RateLimitBurst=0 @@ - #ForwardToSyslog=yes + ForwardToSyslog=yes Mysterious was the 'ForwardToSyslog=yes', which according to Docu defaults to yes, but needed to be explicitly set to get to the wanted "no missed messages" success. My box is heavily used for testing, some odd bursts of messages are more the rule than the exception. - Yamaban. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Yamaban wrote:
On Mon, 7 Mar 2016 18:36, Per Jessen wrote:
Ian, that's a good question, I have also been wondering if the syslog-ng on those systems is backlevel.
a) opensuse 12.3, systemd 195, syslog-ng 3.4.5. No "missed" messages. b) opensuse leap42, systemd 210, syslog-ng 3.7.1, no "missed" messages. c) opensuse 13.1, systemd 208, syslog-ng 3.4.7, no "missed" messages. d) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2-3 messages missed every 5 minutes. e) opensuse 13.2, xen, systemd 210, syslog-ng 3.5.6, 1-2 messages every 15minutes, followed by 34-37 ditto. Very weird.
Looks like it might cron related - in (d), there's a cron-job running every 5 minutes, on (e) there's a cron-job running every 15 minutes.
Hmm, is the (d) + (e) system a upgraded system from a prior (e.g. 13.1) release?
No, they're both fairly fresh 13.2 installs, (d) a little older, (e) is brand new.
b/c from 208 to 210 some of the defaults for journald have changed.
On my Fresh install of Leap42.1 (systemd 210) (rsyslog 8.4.0), I had to set some opts to get to the 'No "missed" messages' state:
file /etc/systemd/journald.conf, diff -U0 style --- Default (or if unset, according to Docu) +++ MySetting: @@ - #SyncIntervalSec=5m + SyncIntervalSec=1m @@ - #RateLimitBurst=1000 + RateLimitBurst=0 @@ - #ForwardToSyslog=yes + ForwardToSyslog=yes
Mysterious was the 'ForwardToSyslog=yes', which according to Docu defaults to yes, but needed to be explicitly set to get to the wanted "no missed messages" success.
My box is heavily used for testing, some odd bursts of messages are more the rule than the exception.
These two boxes are also mostly in test-mode, and as they are both xen dom0, not much logging activity. Thanks for your suggestions about journald.conf, I'll check it out. -- Per Jessen, Zürich (0.6°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-03-07 13:44, Charles Philip Chan wrote:
Per Jessen <> writes:
Hi Per:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
Interesting, what is missing? Maybe you have services not configured for syslog-ng? I have journald storage completely disabled, so I haven't noticed anything. However, I use rsyslog, so YMMV.
I see those messages and I use rsyslog. Telcontar:~ # journalctl --no-pager | grep missed Mar 05 10:47:33 Telcontar systemd-journal[316]: Forwarding to syslog missed 280 messages. Mar 05 10:48:03 Telcontar systemd-journal[316]: Forwarding to syslog missed 142 messages. Mar 05 10:49:30 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 05 10:50:00 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 05 10:50:48 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 05 11:41:55 Telcontar systemd-journal[316]: Forwarding to syslog missed 5 messages. Mar 05 11:42:37 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 05 12:02:49 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 05 13:02:39 Telcontar systemd-journal[316]: Forwarding to syslog missed 4 messages. Mar 05 13:03:09 Telcontar systemd-journal[316]: Forwarding to syslog missed 4 messages. Mar 05 13:50:35 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 05 13:52:41 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 05 18:02:32 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 06 00:04:12 Telcontar systemd-journal[316]: Forwarding to syslog missed 3 messages. Mar 06 02:03:26 Telcontar systemd-journal[316]: Forwarding to syslog missed 3 messages. Mar 06 02:23:25 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 06 12:40:42 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 06 14:40:07 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 06 15:00:00 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 06 15:19:41 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 06 18:40:14 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 06 18:44:56 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 06 19:20:11 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 06 21:57:09 Telcontar systemd-journal[316]: Forwarding to syslog missed 7 messages. Mar 07 02:17:45 Telcontar systemd-journal[316]: Forwarding to syslog missed 4 messages. Mar 07 02:20:01 Telcontar systemd-journal[316]: Forwarding to syslog missed 4 messages. Mar 07 04:16:53 Telcontar systemd-journal[316]: Forwarding to syslog missed 5 messages. Mar 07 04:37:17 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 07 13:49:08 Telcontar systemd-journal[316]: Forwarding to syslog missed 6 messages. Mar 07 13:49:43 Telcontar systemd-journal[316]: Forwarding to syslog missed 8 messages. Mar 07 13:52:00 Telcontar systemd-journal[316]: Forwarding to syslog missed 3 messages. Mar 07 13:53:58 Telcontar systemd-journal[316]: Forwarding to syslog missed 2 messages. Mar 07 14:52:06 Telcontar systemd-journal[316]: Forwarding to syslog missed 4 messages. Mar 07 19:33:22 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 07 19:53:28 Telcontar systemd-journal[316]: Forwarding to syslog missed 1 messages. Mar 07 21:54:00 Telcontar systemd-journal[316]: Forwarding to syslog missed 5 messages. Telcontar:~ # How can I find what was lost? My guess is that systemd does not forward everything to the syslog daemon. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
08.03.2016 00:41, Carlos E. R. пишет:
On 2016-03-07 13:44, Charles Philip Chan wrote:
Per Jessen <> writes:
Hi Per:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
Interesting, what is missing? Maybe you have services not configured for syslog-ng? I have journald storage completely disabled, so I haven't noticed anything. However, I use rsyslog, so YMMV.
I see those messages and I use rsyslog.
rsyslog can pull from journald itself. ...
How can I find what was lost?
You can't (i.e. - you could compare content of journal with content of syslogd stored messages ... unless you already filtered out something on syslogd side). Each Unix socket has fixed size buffer for sent data. If there is no space to store incoming message, normally sender would block. This is acceptable when you have many clients each sending messages to logging daemon independently; you can tolerate accidental sleep of some of them. But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full). In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself. Workaround is to increase socket buffer size for journald - syslogd communication. E.g. current upstream systemd syslog.service sets [Socket] ... ReceiveBuffer=8M This should give more headroom to smooth bursts of activity.
My guess is that systemd does not forward everything to the syslog daemon.
Andrei Borzenkov wrote:
But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full).
In my case, there's hardly any activity on the system, not to mention the log. Only when cron kicks in and wants to write to the log. It seems highly unlikely that such minimal activity should cause the socket buffer to be full. (unless it is incredibly small perhaps).
In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself.
syslog-ng 3.5.4 on openSUSE 13.2 does not have this support, afaict. Which I guess means using ForwardToSyslog=yes, the default. Never mind, I had a nagging doubt and went through my bugreports this morning - https://bugzilla.opensuse.org/show_bug.cgi?id=922191 I'll install a recent syslog-ng 3.6 on a test system and see what happens. -- Per Jessen, Zürich (0.9°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Per Jessen wrote:
Andrei Borzenkov wrote:
But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full).
In my case, there's hardly any activity on the system, not to mention the log. Only when cron kicks in and wants to write to the log. It seems highly unlikely that such minimal activity should cause the socket buffer to be full. (unless it is incredibly small perhaps).
In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself.
syslog-ng 3.5.4 on openSUSE 13.2 does not have this support, afaict. Which I guess means using ForwardToSyslog=yes, the default.
Never mind, I had a nagging doubt and went through my bugreports this morning -
https://bugzilla.opensuse.org/show_bug.cgi?id=922191
I'll install a recent syslog-ng 3.6 on a test system and see what happens.
I installed Peter Czanik's syslog-ng-3.6.4-2.1.i586.rpm. No change, I'm still seeing "systemd-journal[300]: Forwarding to syslog missed 9 messages". Every 15 minutes - 2016-03-08T10:30:01+01:00 sogo systemd[1]: Starting Session 3390 of user root. 2016-03-08T10:30:01+01:00 sogo systemd-journal[300]: Forwarding to syslog missed 1 messages. 2016-03-08T10:30:01+01:00 sogo systemd[1]: Started Session 3390 of user root. 2016-03-08T10:30:42+01:00 sogo systemd-journal[300]: Forwarding to syslog missed 1 messages. 2016-03-08T10:36:33+01:00 sogo wickedd-dhcp4[484]: eth0: Committed DHCPv4 lease with address 192.168.2.159 (lease time 86400 sec, renew in 43200 sec, rebind in 75600 sec) 2016-03-08T10:36:33+01:00 sogo systemd-journal[300]: Forwarding to syslog missed 1 messages. 2016-03-08T10:45:01+01:00 sogo systemd[1]: Starting Session 3391 of user root. 2016-03-08T10:45:01+01:00 sogo systemd[1]: Started Session 3391 of user root. 2016-03-08T10:45:01+01:00 sogo systemd-journal[300]: Forwarding to syslog missed 2 messages. -- Per Jessen, Zürich (1.3°C) http://www.dns24.ch/ - free dynamic DNS, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-03-08 07:07, Andrei Borzenkov wrote:
08.03.2016 00:41, Carlos E. R. пишет:
How can I find what was lost?
You can't (i.e. - you could compare content of journal with content of syslogd stored messages ... unless you already filtered out something on syslogd side).
I have the "allmessages" file, unfiltered. Journal: Mar 08 09:52:42 Telcontar systemd-journal[316]: Forwarding to syslog missed 3 messages. Mar 08 09:52:42 Telcontar leafnode[32602]: connect from localhost (127.0.0.1) to localhost (127.0.0.1) (my fqdn: Telcontar.vali Mar 08 09:52:42 Telcontar leafnode[32601]: connect from localhost (127.0.0.1) to localhost (127.0.0.1) (my fqdn: Telcontar.vali Mar 08 09:55:01 Telcontar systemd[1]: Starting Session 1311 of user news. Mar 08 09:55:01 Telcontar systemd[1]: Started Session 1311 of user news. Mar 08 09:55:01 Telcontar systemd-journal[316]: Forwarding to syslog missed 6 messages. Mar 08 09:55:01 Telcontar systemd[1]: Starting Session 1312 of user wwwrun. Mar 08 09:55:01 Telcontar systemd[1]: Started Session 1312 of user wwwrun. Mar 08 09:55:01 Telcontar /USR/SBIN/CRON[32677]: (wwwrun) CMD ( php /srv/www/cacti/poller.php > /dev/null 2>&1) Mar 08 09:57:19 Telcontar freshclam[2731]: Received signal: wake up allmessages: <63>1 2016-03-08T09:52:42.509483+01:00 Telcontar leafnode 32601 - - >211 530 3 532 comp.os.linux.hardware group selected <63>1 2016-03-08T09:52:42.515981+01:00 Telcontar leafnode 32602 - - <GROUP comp.os.linux.announce <63>1 2016-03-08T09:52:42.516097+01:00 Telcontar leafnode 32602 - - marked group comp.os.linux.announce interesting <63>1 2016-03-08T09:52:42.516106+01:00 Telcontar leafnode 32602 - - markinterest: comp.os.linux.announce touched ctime <63>1 2016-03-08T09:52:42.516111+01:00 Telcontar leafnode 32602 - - >211 32 3 34 comp.os.linux.announce group selected <30>1 2016-03-08T09:55:01.871984+01:00 Telcontar systemd 1 - - Starting Session 1311 of user news. <30>1 2016-03-08T09:55:01.872380+01:00 Telcontar systemd 1 - - Started Session 1311 of user news. <30>1 2016-03-08T09:55:01.874449+01:00 Telcontar systemd 1 - - Starting Session 1312 of user wwwrun. <30>1 2016-03-08T09:55:01.874730+01:00 Telcontar systemd 1 - - Started Session 1312 of user wwwrun. <78>1 2016-03-08T09:55:01.875903+01:00 Telcontar 32677 - - (wwwrun) CMD ( php /srv/www/cacti/poller.php > /dev/null 2>&1) <22>1 2016-03-08T09:57:19.972468+01:00 Telcontar freshclam 2731 - - Received signal: wake up The "connect from localhost" messages are missing in syslog. In fact, it is the journal which is currently filtered, syslog has more messages, but some are missing, probably during the flurry of activity by leafnode. But not always: the messages lost at 09:55:01 happened at an idle moment, and logs are the same at both side.
Each Unix socket has fixed size buffer for sent data. If there is no space to store incoming message, normally sender would block. This is acceptable when you have many clients each sending messages to logging daemon independently; you can tolerate accidental sleep of some of them. But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full).
But AFAIK no messages were lost before systemd started handling the log.
In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself.
Is that the default, or do I have to do something?
Workaround is to increase socket buffer size for journald - syslogd communication. E.g. current upstream systemd syslog.service sets
[Socket] ... ReceiveBuffer=8M
Is that accessible to admins (where), or is it a build option?
This should give more headroom to smooth bursts of activity.
I guess it should be. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
08.03.2016 12:16, Carlos E. R. пишет:
Each Unix socket has fixed size buffer for sent data. If there is no space to store incoming message, normally sender would block. This is acceptable when you have many clients each sending messages to logging daemon independently; you can tolerate accidental sleep of some of them. But in case of systemd there is single process - journald - that is syslogd client and journald is not allowed to block indefinitely. So it is using non-blocking mode and simply discards messages if it cannot send them to syslogd (meaning - socket buffer is full).
But AFAIK no messages were lost before systemd started handling the log.
Yes, that's true. I do not say this is not a problem.
In case of rsyslog the solution is actually to use rsyslog journald support that pulls data itself.
Is that the default, or do I have to do something?
I do not know if this is default in openSUSE package. Otherwise you need to configure corresponding driver.
Workaround is to increase socket buffer size for journald - syslogd communication. E.g. current upstream systemd syslog.service sets
[Socket] ... ReceiveBuffer=8M
Is that accessible to admins (where), or is it a build option?
Yes, of course. You can add drop-in to set (change) it; but I looked at 13.2, Leap and TW (all with up to date patches) and all of them already have the same value. So if this problem is observed on any of these systems, there must be another reason. I remember this was discussed upstream, but I forgot what was the resolution.
This should give more headroom to smooth bursts of activity.
I guess it should be.
On 03/03/2016 05:38 AM, Per Jessen wrote:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
The literal but unhelpful answer is that syslog protocol uses UDP, which has no guarantee of delivery. The Yes-no-maybe depends on a few other things. If you are logging to the "same machine" over a UNIX-socket that's one thing, if you are punting over to another machine then who knows what might be going on. You do say "forwarding". The "quite a lot" may even be an issue of how things are configured. Are the config files identical in every respect? -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Anton Aylward wrote:
On 03/03/2016 05:38 AM, Per Jessen wrote:
I know this should be fairly obvious, I guess the question is _why_ did syslog-ng miss some messages and do I do about it? On some 13.2 systems, I see this quite a lot, on e.g. 12.3 hardly ever.
The literal but unhelpful answer is that syslog protocol uses UDP, which has no guarantee of delivery.
Yes, although not locally. (at least I can't think of a reason why it should).
The Yes-no-maybe depends on a few other things. If you are logging to the "same machine" over a UNIX-socket that's one thing, if you are punting over to another machine then who knows what might be going on. You do say "forwarding".
It's a systemd term for passing messages to syslog.
The "quite a lot" may even be an issue of how things are configured. Are the config files identical in every respect?
Almost certainly, yes. At least for the bits that matter. -- Per Jessen, Zürich (0.6°C) http://www.dns24.ch/ - free dynamic DNS, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
participants (7)
-
Andrei Borzenkov -
Anton Aylward -
Carlos E. R. -
Charles Philip Chan -
ianseeks -
Per Jessen -
Yamaban