Hi,

We are forwarding logs (perl script executed logs) to one Red Hat Linux box. We have to get 97 logs for each time the script runs. But we see inconsistent number of logs coming to Linux box. Like one time we got 56, other time 3 , other time 43.. like this.. We are sure that 97 logs are being forwarded. Checked the Rsyslog.config file for any filters and couldn't see any filter dropping them. When we run the tcpdump, we can see 97 connections, but logs are not there in specified location. Any guesses what happened after 97 connections being received ?

Thanks
Sandeep

At a guess the log is being buffered and you're looking at it before the buffer is written (flushed) to the log file.

On checking syslog man page I see a lot of discussion about buffering. You might want to examine that.