This PR resolves issue #8 where syslog-ng successfully sent logs to Sloggo for several minutes before stopping. #9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- backend/listener/tcp.go: Implemented robust octet counting (RFC 6587) and newline-delimited message parsing with proper error handling - backend/listener/tcp.go: Added TCP keep-alive with 30-second period to prevent silent connection loss - backend/listener/tcp.go: Replaced scanner-based reading with buffered reader and explicit length parsing for reliable message boundaries - backend/main.go: Updated to use standard library contains instead of slices.Contains for compatibility - backend/go.mod: Downgraded Go version from 1.24 to 1.19 and updated go-duckdb dependency to v2.2.0 Improved TCP connection stability by fixing message framing issues and adding keep-alive, ensuring continuous log delivery even after prolonged inactivity. Enhanced parser resilience to malformed or unexpected input while maintaining high throughput.
…93c6967e3b Summary of Changes This PR resolves issue phare#8 where syslog-ng successfully sent logs to Sloggo for several minutes before stopping. The problem was caused by Sloggo's TCP listener not properly handling the octet-counting format (RFC 6587) used by syslog-ng, leading to connection hangs after initial message delivery. Highlights Fixed TCP message parsing: Implemented proper handling of both octet-counting and newline-delimited syslog messages Removed problematic read deadlines: Eliminated connection timeouts that were causing premature disconnections Added TCP keep-alive: Implemented keep-alive mechanism to maintain stable connections Improved connection stability: Fixed the connection hang issue that occurred after 1-2 minutes of initial success Changelog backend/main.go Added TCP keep-alive configuration Removed read deadline that was causing connection drops Implemented proper octet-counting format parsing for syslog-ng compatibility Added robust message parsing to handle both octet-counting and newline-delimited formats Improved error handling for malformed messages Pull Request Description This PR fixes the issue where syslog-ng would stop sending logs to Sloggo after an initial period of success. The root cause was improper handling of syslog-ng's octet-counting format in Sloggo's TCP listener. The changes implement proper parsing for both octet-counting and newline-delimited messages, remove problematic read deadlines, and add TCP keep-alive to ensure stable, continuous log delivery.
Contributor
|
Hello @tnl-o, The |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of Changes
This PR resolves issue #8 where syslog-ng successfully sent logs to Sloggo for several minutes before stopping. The problem was caused by Sloggo's TCP listener not properly handling the octet-counting format (RFC 6587) used by syslog-ng, leading to connection hangs after initial message delivery.
Highlights
Fixed TCP message parsing: Implemented proper handling of both octet-counting and newline-delimited syslog messages
Removed problematic read deadlines: Eliminated connection timeouts that were causing premature disconnections
Added TCP keep-alive: Implemented keep-alive mechanism to maintain stable connections
Improved connection stability: Fixed the connection hang issue that occurred after 1-2 minutes of initial success
Changelog
backend/main.go
Added TCP keep-alive configuration
Removed read deadline that was causing connection drops
Implemented proper octet-counting format parsing for syslog-ng compatibility
Added robust message parsing to handle both octet-counting and newline-delimited formats
Improved error handling for malformed messages
Pull Request Description
This PR fixes the issue where syslog-ng would stop sending logs to Sloggo after an initial period of success. The root cause was improper handling of syslog-ng's octet-counting format in Sloggo's TCP listener. The changes implement proper parsing for both octet-counting and newline-delimited messages, remove problematic read deadlines, and add TCP keep-alive to ensure stable, continuous log delivery.