Reproduction confirmed the issue is related to the syslog-ng-ctl query command. It resets the queue counter but that should not be reset. Then the queue counter can underflow and cause issues in other stat counters that rely on it. This Software Defect (ID 437310) causes a cosmetic issue in stat output.
原因
Reproduction showed the /opt/syslog-ng/sbin/syslog-ng-ctl query get .dst.net* --reset command able to reset the queue counter, while the /opt/syslog-ng/sbin/syslog-ng-ctl stats --reset command does not.
Once the queue counter is reset it easily underflows and breaks other statistics like memory and eps.
対策
If the customer wants to reset stats we recommend resetting all the stats with syslog-ng-ctl stats --reset.