Syslog-ng Not Sending Logs Out Through Destination (4234085)

Syslog-ng Not Sending Logs Out Through Destination

Logs are coming into Syslog-ng PE, however, logs are not being sent out through the destination even though the connection is open. A telnet connection may show that the listening destination is available.

Flow-control is enabled and the destination cannot process logs further. An example of this would be:

Syslog-ng PE Relay > Syslog-ng Store Box > SIEM

If the SIEM at the end of the line of logs is unreachable and flow-control is enabled, the Syslog-ng Store Box (SSB) will stop accepting logs which will cause Syslog-ng PE Relay to not be able to send logs to the SSB.

If flow-control was disabled in this scenario logs will instead buffer on a disk-buffer (if enabled and configured) rather than stop processing logs.

The resolution is to ensure that the chain from start to finish is able to send/receive logs. If flow-control is enabled and any bottleneck is present, flow-control will control the flow thus stopping the flow of logs.

If using a disk-buffer it is recommended to remove flow-control from the configuration as the disk-buffer will be bypassed when flow-control is enabled.