Re: stats collection sometimes wrong
Hofi <[email protected]> Wed, 8 Oct 2025 10:24:27 +0200
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <e1e3c63c-0d57-4058-8ca2-971c6fac6618@Spark> |
--===============5955272523925803634== Content-Type: multipart/alternative; boundary="68e61fc0_641b0b45_336" --68e61fc0_641b0b45_336 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Also, Even, could you please elaborate=3F What version of syslog-ng produces this=3F (Please attach the output of =60= syslog-ng -V=60) Are you using =60syslog-ng-ctl stats =E2=80=94reset=60 or =60syslog-ng-ct= l reload=60 when you experience this problem=3F TIA=21 =E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2= =80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80= =94 Hoffmann Istvan On Oct 6, 2025 at 10:57 +0200, Hofi <hofione=40gmail.com>, wrote: > Evan, could you please attach a belonging, simplified syslog-ng config = that I can use to reproduce this issue=3F > TIA=21 > > ----------------------------------- > Hofi - Istvan Hoffmann > https://memyselfandi.hu > https://mantisliagames.com > On Sep 17, 2025 at 17:39 +0200, Hofi <hofione=40gmail.com>, wrote: > > Hi, > > > > I guess this is reported here as well. > > > > https://github.com/syslog-ng/syslog-ng/issues/5351 > > > > > > We will investigate it, thanks. > > > > Cheers > > > > =E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80= =94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94= =E2=80=94 > > Hoffmann Istvan > > On Sep 17, 2025 at 16:59 +0200, Evan Rempel <erempel=40uvic.ca>, wrot= e: > > > We collect stats every 10 minutes via the command > > > > > > syslog-ng-ctl=C2=A0stats --control=3D=24syslogSocket > > > > > > And we log the results=C2=A0 back to syslog as well as generate ale= rts when things start queuing. > > > > > > Sometimes the queued numbers reported are extremely incorrect. > > > > > > 2025-09-16T21:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;0 > > > 2025-09-16T21:25:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;0 > > > 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;0 > > > 2025-09-16T21:35:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;processed;15568 > > > 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;1844674407370955160= 8 > > > 2025-09-16T21:45:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;processed;15773 > > > 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;1844674407370955160= 8 > > > 2025-09-16T21:55:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;processed;15972 > > > 2025-09-16T22:05:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;0 > > > 2025-09-16T22:15:12 host=C2=A0syslog.info syslog-ng-stats=5B94472=5D= : statistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/sys= log/unknown/telegraf.unknown.20250916.000000;a;queued;0 > > > > > > It is not possible to queue more messages that the difference repor= ted in the processed numbers. > > > > > > -- > > > Evan > > > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F > > > Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s > > > Documentation: http://www.balabit.com/support/documentation/=3Fprod= uct=3Dsyslog-ng > > > =46AQ: http://www.balabit.com/wiki/syslog-ng-faq > > > --68e61fc0_641b0b45_336 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <html xmlns=3D=22http://www.w3.org/1999/xhtml=22> <head> <title></title> </head> <body> <div name=3D=22messageBodySection=22> <div dir=3D=22auto=22>Also, Even, could you please elaborate=3F<br /> What version of syslog-ng produces this=3F (Please attach the output of =60= syslog-ng -V=60)<br /> Are you using =60syslog-ng-ctl stats =E2=80=94reset=60 or =60syslog-ng-ct= l reload=60 when you experience this problem=3F<br /> <br /> TIA=21</div> </div> <div name=3D=22messageSignatureSection=22><br /> <div class=3D=22match=46ont=22>=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80= =94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94= =E2=80=94=E2=80=94=E2=80=94=E2=80=94 <div dir=3D=22auto=22>Hoffmann Istvan</div> </div> </div> <div name=3D=22messageReplySection=22>On Oct 6, 2025 at 10:57 +0200, Hofi= <hofione=40gmail.com>, wrote:<br /> <blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-= left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:= 10px;=22> <div name=3D=22messageBodySection=22> <div dir=3D=22auto=22>Evan, could you please attach a belonging, simplifi= ed syslog-ng config that I can use to reproduce this issue=3F<br /> TIA=21</div> </div> <div name=3D=22messageSignatureSection=22><br /> <div dir=3D=22auto=22>-----------------------------------<br /> <div>Hofi - Istvan Hoffmann</div> <div>https://memyselfandi.hu</div> <div dir=3D=22auto=22>https://mantisliagames.com</div> </div> </div> <div name=3D=22messageReplySection=22>On Sep 17, 2025 at 17:39 +0200, Hof= i <hofione=40gmail.com>, wrote:<br /> <blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-= left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:= 10px;=22> <div name=3D=22messageBodySection=22> <div dir=3D=22auto=22>Hi,<br /> <br /> I guess this is reported here as well.<br /> <br /> <a href=3D=22https://github.com/syslog-ng/syslog-ng/issues/5351=22 target= =3D=22=5Fblank=22>https://github.com/syslog-ng/syslog-ng/issues/5351</a><= br /> <br /> <br /> We will investigate it, thanks.<br /> <br /> Cheers</div> </div> <div name=3D=22messageSignatureSection=22><br /> <div class=3D=22match=46ont=22>=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80= =94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94= =E2=80=94=E2=80=94=E2=80=94=E2=80=94 <div dir=3D=22auto=22>Hoffmann Istvan</div> </div> </div> <div name=3D=22messageReplySection=22>On Sep 17, 2025 at 16:59 +0200, Eva= n Rempel <erempel=40uvic.ca>, wrote:<br /> <blockquote type=3D=22cite=22 style=3D=22border-left-color: grey; border-= left-width: thin; border-left-style: solid; margin: 5px 5px;padding-left:= 10px;=22> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>We collect stats every 10 minute= s via the command</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>syslog-ng-ctl&=23160;stats --con= trol=3D=24syslogSocket</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>And we log the results&=23160; b= ack to syslog as well as generate alerts when things start queuing.</div>= <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>Sometimes the queued numbers rep= orted are extremely incorrect.</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:15:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;queued;0</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:25:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;queued;0</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;queued;0</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:35:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;processed;15568<br /> 2025-09-16T21:45:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s= tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog= /unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</= div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:45:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;processed;15773<br /> 2025-09-16T21:55:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s= tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog= /unknown/telegraf.unknown.20250916.000000;a;queued;18446744073709551608</= div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T21:55:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;processed;15972<br /> 2025-09-16T22:05:12 host&=23160;syslog.info syslog-ng-stats=5B94472=5D: s= tatistics: syslogserver;dst.file;d=5Fauthorized=5Funknown=230;/var/syslog= /unknown/telegraf.unknown.20250916.000000;a;queued;0</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>2025-09-16T22:15:12 host&=23160;= syslog.info syslog-ng-stats=5B94472=5D: statistics: syslogserver;dst.file= ;d=5Fauthorized=5Funknown=230;/var/syslog/unknown/telegraf.unknown.202509= 16.000000;a;queued;0</div> <div class=3D=22elementToProof=22 id=3D=22Signature=22> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22>It is not possible to queue more= messages that the difference reported in the processed numbers.</div> <div style=3D=22font-family: Aptos, Aptos=5FEmbedded=46ont, Aptos=5FMS=46= ontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0= , 0, 0);=22 class=3D=22elementToProof=22><br /></div> <div style=3D=22font-family: "Courier New", monospace; color: r= gb(153, 153, 153);=22 class=3D=22elementToProof=22><span style=3D=22font-= size: 14.6667px; background-color: rgb(255, 255, 255);=22>--</span><span = style=3D=22font-size: 12pt;=22><br /></span> <span style=3D=22font-size: = 14.6667px; background-color: rgb(255, 255, 255);=22>Evan</span></div> </div> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F<br /> Member info: %(web=5Fpage=5Furl)slistinfo/%(=5Finternal=5Fname)s<br /> Documentation: http://www.balabit.com/support/documentation/=3Fproduct=3D= syslog-ng<br /> =46AQ: http://www.balabit.com/wiki/syslog-ng-faq<br /> <br /></blockquote> </div> </blockquote> </div> </blockquote> </div> </body> </html> --68e61fc0_641b0b45_336-- --===============5955272523925803634== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: %(web_page_url)slistinfo/%(_internal_name)s Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============5955272523925803634==--