stats collection sometimes wrong
Evan Rempel <[email protected]> Wed, 17 Sep 2025 14:59:31 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <YT2P288MB01728E2FD12BA1B281DF577DB917A@YT2P288MB0172.CANP288.PROD.OUTLOOK.COM> |
--===============7322447770883068617==
Content-Language: en-CA
Content-Type: multipart/alternative;
boundary="_000_YT2P288MB01728E2FD12BA1B281DF577DB917AYT2P288MB0172CANP_"
--_000_YT2P288MB01728E2FD12BA1B281DF577DB917AYT2P288MB0172CANP_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
We collect stats every 10 minutes via the command
syslog-ng-ctl stats --control=3D$syslogSocket
And we log the results back to syslog as well as generate alerts when thin=
gs start queuing.
Sometimes the queued numbers reported are extremely incorrect.
2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;0
2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;0
2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;0
2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;processed;15568
2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;18446744073709551608
2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;processed;15773
2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;18446744073709551608
2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;processed;15972
2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;0
2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistics: sy=
slogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegraf.unk=
nown.20250916.000000;a;queued;0
It is not possible to queue more messages that the difference reported in t=
he processed numbers.
--
Evan
--_000_YT2P288MB01728E2FD12BA1B281DF577DB917AYT2P288MB0172CANP_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
We collect stats every 10 minutes via the command</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
syslog-ng-ctl stats --control=3D$syslogSocket</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
And we log the results back to syslog as well as generate alerts when=
things start queuing.</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
Sometimes the queued numbers reported are extremely incorrect.</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:15:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;0</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:25:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;0</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;0</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:35:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;processed;15568<br>
2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;18446744073709551608</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:45:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;processed;15773<br>
2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;18446744073709551608</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T21:55:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;processed;15972<br>
2025-09-16T22:05:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;0</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
2025-09-16T22:15:12 host syslog.info syslog-ng-stats[94472]: statistic=
s: syslogserver;dst.file;d_authorized_unknown#0;/var/syslog/unknown/telegra=
f.unknown.20250916.000000;a;queued;0</div>
<div class=3D"elementToProof" id=3D"Signature">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
It is not possible to queue more messages that the difference reported in t=
he processed numbers.</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: "Courier New", monospace; color: rgb(1=
53, 153, 153);" class=3D"elementToProof">
<span style=3D"font-size: 14.6667px; background-color: rgb(255, 255, 255);"=
>--</span><span style=3D"font-size: 12pt;"><br>
</span><span style=3D"font-size: 14.6667px; background-color: rgb(255, 255,=
255);">Evan</span></div>
</div>
</body>
</html>
--_000_YT2P288MB01728E2FD12BA1B281DF577DB917AYT2P288MB0172CANP_--
--===============7322447770883068617==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________________________________________
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--===============7322447770883068617==--