Re: [Devil-linux-develop] syslog-ng version

[Serge L. <fi...@in...>]

On 11/21/2009 04:26 AM, Heiko Zuerker wrote:
> Hey,
> 
> I just upgraded all my VMs to the latest and greatest DL and about half of
> them had syslog-ng crash after not even a minute.
> The syslog-ng doesn't even get reloaded during the upgrade, it's simply not
> running when the files are changed.

:-(

> I'll refert back to unix-dgram and see what happens in the next upgrade.
> Serge, do you remember why you switched it from unix-dgram to unix-stream?
> 
Sure.
There were 2 reasons - the first one is the explanation from syslog-ng 1.6
documentation about messages loosing probability:

unix-stream() and unix-dgram()

These two drivers behave similarly: they open the given AF_UNIX socket and start
listening on it for messages. unix-stream() is primarily used on Linux and uses
SOCK_STREAM semantics (connection oriented, no messages are lost); while
unix-dgram() is used on BSDs and uses SOCK_DGRAM semantics: this may result in
lost local messages if the system is overloaded.

http://www.cs.utah.edu/~clake/docs/syslog-ng-1.6/#id2525653

and the second one is multiline messages handling ( I got the same result from
my experiments (JBOSS sends multiline messages), but in the message below Bazsi
explains the reason of the difference)

> In short, when multiline log messages sent via /dev/log socket they are
> splitted into multiple log entries. Only first entry will have proper
> timestamp and facility.
>
> This behavior differs from sysklogd and metalog, where multiple lines are
> concatenated.
> Even syslog-ng itself concatenates them when used via udp socket.
>
> Tested on syslog-ng-2.1.3.

I guess this depends on whether you are using unix-stream() or
unix-dgram().

The first concatenates it, the 2nd doesn't. Simply because unix-dgram
knows about the size of the datagrams whereas unix-stream doesn't.

https://lists.balabit.hu/pipermail/syslog-ng/2009-September/013330.html


I switched to "unix-stream" because the both of them work pretty well and
"stream" looks to be  a bit more attractive. If the problem is in this option
let's revert it to "dgram".

Serge