Re: stats collection sometimes wrong

Hofi <[email protected]> Mon, 6 Oct 2025 10:57:15 +0200
Newsgroups	gmane.comp.syslog-ng
Message-ID	<90debce4-4e3e-4f7b-a669-92e18926e078@Spark>
--===============1001934015317454902==
Content-Type: multipart/alternative; boundary="68e38470_7b1e0da8_982"

--68e38470_7b1e0da8_982
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Evan, could you please attach a belonging, simplified syslog-ng config th=
at I can use to reproduce this issue=3F
TIA=21

-----------------------------------
Hofi - Istvan Hoffmann
https://memyselfandi.hu
https://mantisliagames.com
On Sep 17, 2025 at 17:39 +0200, Hofi <hofione=40gmail.com>, wrote:
> Hi,
>
> I guess this is reported here as well.
>
> https://github.com/syslog-ng/syslog-ng/issues/5351
>
>
> We will investigate it, thanks.
>
> Cheers
>
> =E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=
=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=
=80=94
> Hoffmann Istvan
> On Sep 17, 2025 at 16:59 +0200, Evan Rempel <erempel=40uvic.ca>, wrote:=

> > We collect stats every 10 minutes via the command
> >
> > syslog-ng-ctl=C2=A0stats --control=3D=24syslogSocket
> >
> > And we log the results=C2=A0 back to syslog as well as generate alert=
s when things start queuing.
> >
> > Sometimes the queued numbers reported are extremely incorrect.
> >
> > 2025-09-16T21:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;0
> > 2025-09-16T21:25:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;0
> > 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;0
> > 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;processed;15568
> > 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608=

> > 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;processed;15773
> > 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608=

> > 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;processed;15972
> > 2025-09-16T22:05:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;0
> > 2025-09-16T22:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D:=
 statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sysl=
og/unknown/telegraf.unknown.20250916.000000;a;queued;0
> >
> > It is not possible to queue more messages that the difference reporte=
d in the processed numbers.
> >
> > --
> > Evan
> > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F
> > Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s
> > Documentation: http://www.balabit.com/support/documentation/=3Fproduc=
t=3Dsyslog-ng
> > =46AQ: http://www.balabit.com/wiki/syslog-ng-faq
> >

--68e38470_7b1e0da8_982
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html xmlns=3D=22http://www.w3.org/1999/xhtml=22>
<head>
<title></title>
</head>
<body>
<div name=3D=22messageBodySection=22>
<div dir=3D=22auto=22>Evan, could you please attach a belonging, simplifi=
ed syslog-ng config that I can use to reproduce this issue=3F<br />
TIA=21</div>
</div>
<div name=3D=22messageSignatureSection=22><br />
<div dir=3D=22auto=22>-----------------------------------<br />
<div>Hofi - Istvan Hoffmann</div>
<div>https://memyselfandi.hu</div>
<div dir=3D=22auto=22>https://mantisliagames.com</div>
</div>
</div>
<div name=3D=22messageReplySection=22>On Sep 17, 2025 at 17:39 +0200, Hof=
i &lt;hofione=40gmail.com&gt;, wrote:<br />
<blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-=
left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:=
 10px;=22>
<div name=3D=22messageBodySection=22>
<div dir=3D=22auto=22>Hi,<br />
<br />
I guess this is reported here as well.<br />
<br />
<a href=3D=22https://github.com/syslog-ng/syslog-ng/issues/5351=22 target=
=3D=22=5Fblank=22>https://github.com/syslog-ng/syslog-ng/issues/5351</a><=
br />
<br />
<br />
We will investigate it, thanks.<br />
<br />
Cheers</div>
</div>
<div name=3D=22messageSignatureSection=22><br />
<div class=3D=22match=46ont=22>=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=
=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=
=E2=80=94=E2=80=94=E2=80=94=E2=80=94
<div dir=3D=22auto=22>Hoffmann Istvan</div>
</div>
</div>
<div name=3D=22messageReplySection=22>On Sep 17, 2025 at 16:59 +0200, Eva=
n Rempel &lt;erempel=40uvic.ca&gt;, wrote:<br />
<blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-=
left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:=
 10px;=22>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>We collect stats every 10 minute=
s via the command</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>syslog-ng-ctl&=23160;stats --con=
trol=3D=24syslogSocket</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>And we log the results&=23160; b=
ack to syslog as well as generate alerts when things start queuing.</div>=

<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>Sometimes the queued numbers rep=
orted are extremely incorrect.</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:15:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:25:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15568<br />
2025-09-16T21:45:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</=
div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:45:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15773<br />
2025-09-16T21:55:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</=
div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:55:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;processed;15972<br />
2025-09-16T22:05:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s=
tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog=
/unknown/telegraf.unknown.20250916.000000;a;queued;0</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T22:15:12 host&=23160;=
syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file=
;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509=
16.000000;a;queued;0</div>
<div class=3D=22elementToProof=22 id=3D=22Signature=22>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22>It is not possible to queue more=
 messages that the difference reported in the processed numbers.</div>
<div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46=
ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);=22 class=3D=22elementToProof=22><br /></div>
<div style=3D=22font-family: &quot;Courier New&quot;, monospace; color: r=
gb(153, 153, 153);=22 class=3D=22elementToProof=22><span style=3D=22font-=
size: 14.6667px; background-color: rgb(255, 255, 255);=22>--</span><span =
style=3D=22font-size: 12pt;=22><br /></span> <span style=3D=22font-size: =
14.6667px; background-color: rgb(255, 255, 255);=22>Evan</span></div>
</div>
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F<br />
Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s<br />
Documentation: http://www.balabit.com/support/documentation/=3Fproduct=3D=
syslog-ng<br />
=46AQ: http://www.balabit.com/wiki/syslog-ng-faq<br />
<br /></blockquote>
</div>
</blockquote>
</div>
</body>
</html>

--68e38470_7b1e0da8_982--


--===============1001934015317454902==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

______________________________________________________________________________
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


--===============1001934015317454902==--