wiht the community eddition when the nxlog-ce is listening on /dev/log and for some reasons the systemd-journald (debian 9) removes the socket the nxlog blocks the compleate host. (even no login possible) after a restart of nxlog the host recovers.

AskedJanuary 22, 2018 - 1:01pm

Answer (1)

Unfortunately /dev/log blocks under linux. If you have a process logging to /dev/log via syslog(3) the call will block when the socket buffer is full so there must be a daemon (e.g. nxlog or rsyslog) emptying the socket buffer.

If you configure nxlog to use im_uds => om_tcp and the remote TCP connection goes down you will end up with this situation. it is recommended to turn of flow control as noted in the User Guide.