{"action":"created","issue":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/713","labels_url":"https://api.github.com/repos/balabit/syslog-ng/issues/713/labels{/name}","comments_url":"https://api.github.com/repos/balabit/syslog-ng/issues/713/comments","events_url":"https://api.github.com/repos/balabit/syslog-ng/issues/713/events","html_url":"https://github.com/balabit/syslog-ng/issues/713","id":107963414,"number":713,"title":"syslog-ng reload causes mod-journal to re-read all messages ever since","user":{"login":"zstyblik","id":6183869,"avatar_url":"https://avatars.githubusercontent.com/u/6183869?v=3","gravatar_id":"","url":"https://api.github.com/users/zstyblik","html_url":"https://github.com/zstyblik","followers_url":"https://api.github.com/users/zstyblik/followers","following_url":"https://api.github.com/users/zstyblik/following{/other_user}","gists_url":"https://api.github.com/users/zstyblik/gists{/gist_id}","starred_url":"https://api.github.com/users/zstyblik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zstyblik/subscriptions","organizations_url":"https://api.github.com/users/zstyblik/orgs","repos_url":"https://api.github.com/users/zstyblik/repos","events_url":"https://api.github.com/users/zstyblik/events{/privacy}","received_events_url":"https://api.github.com/users/zstyblik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":23,"created_at":"2015-09-23T17:02:57Z","updated_at":"2015-09-29T10:04:17Z","closed_at":null,"body":"EDIT: I'm keeping original message, although it's somewhat incorrect.\r\n\r\nHello,\r\n\r\nwe have syslog-ng 3.6.4-1 with mod-journal. When syslog-ng is reloaded, eg. via `/etc/init.d/syslog-ng reload`, all syslog messages there ever were since syslog-ng 3.6.4 has been installed are read and send/logged again. I get syslog messages as far as Sep 9.\r\nI believe mod-journal is having some problem keeping the track of which messages have been processed and which not. Machine has been rebooted several times since installation of syslog-ng, so that shouldn't be it. Configuration is pretty much stock one as far as local machine goes.\r\n\r\nThank you in advance.\r\n\r\n---\r\n**Original message**\r\nHello,\r\n\r\nwe have syslog-ng 3.6.4-1 instance(s) which you could call relays. They receive syslog messages from remote hosts and relay messages to other destinations(file/net). I've noticed when syslog-ng is reloaded it resends all or most or simply really a lot of messages again to all destinations including a file destination. These messages are even 14+ days old.\r\n\r\nIs this expected? Please, do you have any hint what could possibly be misconfigured?\r\n\r\nThank you in advance."},"comment":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/comments/144012480","html_url":"https://github.com/balabit/syslog-ng/issues/713#issuecomment-144012480","issue_url":"https://api.github.com/repos/balabit/syslog-ng/issues/713","id":144012480,"user":{"login":"juhaszviktor","id":2157202,"avatar_url":"https://avatars.githubusercontent.com/u/2157202?v=3","gravatar_id":"","url":"https://api.github.com/users/juhaszviktor","html_url":"https://github.com/juhaszviktor","followers_url":"https://api.github.com/users/juhaszviktor/followers","following_url":"https://api.github.com/users/juhaszviktor/following{/other_user}","gists_url":"https://api.github.com/users/juhaszviktor/gists{/gist_id}","starred_url":"https://api.github.com/users/juhaszviktor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juhaszviktor/subscriptions","organizations_url":"https://api.github.com/users/juhaszviktor/orgs","repos_url":"https://api.github.com/users/juhaszviktor/repos","events_url":"https://api.github.com/users/juhaszviktor/events{/privacy}","received_events_url":"https://api.github.com/users/juhaszviktor/received_events","type":"User","site_admin":false},"created_at":"2015-09-29T10:04:17Z","updated_at":"2015-09-29T10:04:17Z","body":"Hi\n\nI tried to reproduce your issue on gentoo test machine, but I've no success.\n\nI start the syslog-ng, it sends the whole of the journal, but after restart\n (systemctl restart syslog-ng) it continues from the last sent message, as\nexpected.\nPlease check my configuration and the machine, and try to find out the\ndifferences.\n\n\nmachine is:\n\"\nlocalhost# uname -a\nLinux localhost 4.0.5-gentoo #1 SMP Mon Sep 28 13:38:48 2015 x86_64 Intel\nCore Processor (Haswell, no TSX) GenuineIntel GNU/Linux\n\"\n\nMy systemd version is:\n\"\n*  sys-apps/systemd\n      Latest version available: 218-r5\n      Latest version installed: 218-r5\n      Size of files: 3.694 KiB\n      Homepage:      http://www.freedesktop.org/wiki/Software/systemd\n      Description:   System and service manager for Linux\n      License:       GPL-2 LGPL-2.1 MIT public-domain\n\"\n\nsyslog-ng:\n\"\n*  app-admin/syslog-ng\n      Latest version available: 3.6.4\n      Latest version installed: 3.6.4\n      Size of files: 3.200 KiB\n      Homepage:      http://www.balabit.com/network-security/syslog-ng\n      Description:   syslog replacement with advanced filtering features\n      License:       GPL-2+ LGPL-2.1+\n\"\n\nOn my machine I used this config:\n\"\n@version: 3.6\n# $Id$\n#\n# Syslog-ng default configuration file for Gentoo Linux\n\n# https://bugs.gentoo.org/show_bug.cgi?id=426814\n@include \"scl.conf\"\n\noptions {\nthreaded(yes);\nchain_hostnames(no);\n\n# The default action of syslog-ng is to log a STATS line\n# to the file every 10 minutes.  That's pretty ugly after a while.\n# Change it to every 12 hours so you get a nice daily update of\n# how many messages syslog-ng missed (0).\nstats_freq(43200);\n# The default action of syslog-ng is to log a MARK line\n# to the file every 20 minutes.  That's seems high for most\n# people so turn it down to once an hour.  Set it to zero\n# if you don't want the functionality at all.\nmark_freq(3600);\n};\n\nsource src { system(); internal(); };\ndestination messages { syslog(\"server\" port(5555)); };\n\nlog { source(src); destination(messages); };\n\"\n\n\n\nOn Tue, Sep 29, 2015 at 10:50 AM, Zdenek Styblik <notifications@github.com>\nwrote:\n\n> I'll try to replicate issue in (two; sender-receiver) LXCs. However, as\n> I've said earlier and if my understanding of flow-control indicators is\n> correct, there is no flow-control going on. I mean, there are no stored\n> messages.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/balabit/syslog-ng/issues/713#issuecomment-143992357>.\n>\n"}}