Re: stats collection sometimes wrong

Hofi <[email protected]> Wed, 17 Sep 2025 17:39:54 +0200
Newsgroups	gmane.comp.syslog-ng
Message-ID	<c7e53e07-8494-4c59-b3f8-aec548eac38a@Spark>
--===============8712516289669571561==
Content-Type: multipart/alternative; boundary="68cad64f_1fe7ace7_327"

--68cad64f_1fe7ace7_327
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi,

I guess this is reported here as well.

https://github.com/syslog-ng/syslog-ng/issues/5351


We will investigate it, thanks.

Cheers

=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=
=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=
=94
Hoffmann Istvan
On Sep 17, 2025 at 16:59 +0200, Evan Rempel <erempel=40uvic.ca>, wrote:
> We collect stats every 10 minutes via the command
>
> syslog-ng-ctl=C2=A0stats --control=3D=24syslogSocket
>
> And we log the results=C2=A0 back to syslog as well as generate alerts =
when things start queuing.
>
> Sometimes the queued numbers reported are extremely incorrect.
>
> 2025-09-16T21:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0
> 2025-09-16T21:25:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0
> 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0
> 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;processed;15568
> 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608
> 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;processed;15773
> 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608
> 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;processed;15972
> 2025-09-16T22:05:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0
> 2025-09-16T22:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0
>
> It is not possible to queue more messages that the difference reported =
in the processed numbers.
>
> --
> Evan
> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F
> Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s
> Documentation: http://www.balabit.com/support/documentation/=3Fproduct=3D=
syslog-ng
> =46AQ: http://www.balabit.com/wiki/syslog-ng-faq
>

--68cad64f_1fe7ace7_327
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html xmlns=3D=22http://www.w3.org/1999/xhtml=22>
<head>
<title></title>
</head>
<body>
<div name=3D=22messageBodySection=22>
<div dir=3D=22auto=22>Hi,<br />
<br />
I guess this is reported here as well.<br />
<br />
<a href=3D=22https://github.com/syslog-ng/syslog-ng/issues/5351=22 target=
=3D=22=5Fblank=22>https://github.com/syslog-ng/syslog-ng/issues/5351</a><=
br />
<br />
<br />
We will investigate it, thanks.<br />
<br />
Cheers</div>
</div>
<div name=3D=22messageSignatureSection=22><br />
<div class=3D=22match=46ont=22>=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=
=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=
=E2=80=94=E2=80=94=E2=80=94=E2=80=94
<div dir=3D=22auto=22>Hoffmann Istvan</div>
</div>
</div>
<div name=3D=22messageReplySection=22>On Sep 17, 2025 at 16:59 +0200, Eva=
n Rempel &lt;erempel=40uvic.ca&gt;, wrote:<br />
<blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-=
left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:=
 10px;=22>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>We collect stats every 10 minute=
s via the command</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>syslog-ng-ctl&=23160;stats --con=
trol=3D=24syslogSocket</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>And we log the results&=23160; b=
ack to syslog as well as generate alerts when things start queuing.</div>=

<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>Sometimes the queued numbers rep=
orted are extremely incorrect.</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:15:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:25:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15568<br />
2025-09-16T21:45:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</=
div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:45:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15773<br />
2025-09-16T21:55:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</=
div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:55:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15972<br />
2025-09-16T22:05:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T22:15:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div class=3D=22elementToProof=22 id=3D=22Signature=22>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>It is not possible to queue more=
 messages that the difference reported in the processed numbers.</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: &quot;Courier New&quot;, monospace; color: r=
gb(153, 153, 153);=22 class=3D=22elementToProof=22><span style=3D=22font-=
size: 14.6667px; background-color: rgb(255, 255, 255);=22>--</span><span =
style=3D=22font-size: 12pt;=22><br /></span> <span style=3D=22font-size: =
14.6667px; background-color: rgb(255, 255, 255);=22>Evan</span></div>
</div>
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F<br />
Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s<br />
Documentation: http://www.balabit.com/support/documentation/=3Fproduct=3D=
syslog-ng<br />
=46AQ: http://www.balabit.com/wiki/syslog-ng-faq<br />
<br /></blockquote>
</div>
</body>
</html>

--68cad64f_1fe7ace7_327--


--===============8712516289669571561==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

______________________________________________________________________________
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


--===============8712516289669571561==--