we are seeing issue with syslog-ng 3.8.1 dropping logs with older timestamp. Our system has an issue in persisting hardware clock after a reboot however, it might be an issue even with ntp jitter as well.
It appears that if syslog-ng sees a log with a specific time, any log generated with older timestamp gets rejected.. While we see the logs getting received by syslog-ng, it is not clear why we don't see them getting processed.
We have also observed that simply changing system time (going behind the clock) without reload is also causing syslog-ng to freeze.
Upgrading to syslog-ng 3.22 doesn't help either. Enabling NTP does help to solve the issue but time jitter correction could freeze syslog-ng again.
Anyone is experiencing this issue? If so, any global config that we need to enable?
stats doesnt change:
root@MYDEV:~# syslog-ng-ctl stats
SourceName;SourceId;SourceInstance;State;Type;Number
center;;received;a;processed;5
src.internal;s_src#0;;a;processed;5
src.internal;s_src#0;;a;stamp;1478194222
destination;d_messages;;a;processed;5
destination;d_console_all;;a;processed;1
destination;#anon-destination1;;a;processed;0
destination;#anon-destination0;;a;processed;0
destination;#anon-destination3;;a;processed;0
destination;d_syslog;;a;processed;5
center;;queued;a;processed;11
destination;#anon-destination4;;a;processed;0
destination;#anon-destination2;;a;processed;0
destination;d_console;;a;processed;0
global;payload_reallocs;;a;processed;0
src.journald;;journal;a;processed;0
src.journald;;journal;a;stamp;0
global;sdata_updates;;a;processed;0
global;msg_clones;;a;processed;0
source;s_src;;a;processed;5
global;internal_queue_length;;a;processed;0
root@MYDEV:~#
root@MYDEV:~# <<<<< TRIGGERED A MESSAGE; can see it on journald >>>>
root@MYDEV:~#
root@MYDEV:~# syslog-ng-ctl stats
SourceName;SourceId;SourceInstance;State;Type;Number
center;;received;a;processed;5
src.internal;s_src#0;;a;processed;5
src.internal;s_src#0;;a;stamp;1478194222
destination;d_messages;;a;processed;5
destination;d_console_all;;a;processed;1
destination;#anon-destination1;;a;processed;0
destination;#anon-destination0;;a;processed;0
destination;#anon-destination3;;a;processed;0
destination;d_syslog;;a;processed;5
center;;queued;a;processed;11
destination;#anon-destination4;;a;processed;0
destination;#anon-destination2;;a;processed;0
destination;d_console;;a;processed;0
global;payload_reallocs;;a;processed;0
src.journald;;journal;a;processed;0
src.journald;;journal;a;stamp;0
global;sdata_updates;;a;processed;0
global;msg_clones;;a;processed;0
source;s_src;;a;processed;5
global;internal_queue_length;;a;processed;0
Thanks
