My users are complaining that some of the exception messages issued by their software package does not always show up in syslog. They saw the exceptions in the application log. These exception shpuld have also generated an entry to syslog. However they seem to be missing intermittently. Is this more likely an application problem or AIX problem. I need some advice on how I can perform further problem determination. I am using AIX 53.
Are the messages generated on one host and sent across the network to a logging host? If so, you are experiencing the poor syslog design. Syslog entries are sent across the network via UDP and UDP does not guarantee reliable delivery. Some other services like NFS also use UDP but have application level recovery for dropped UDP datagrams. But syslog just lets them get lost. This would tend to happen when the network is busy.
If the messages are generated and logged on the same host, then they should not get lost.
These are all local. If there is no reason for the syslog entry to disappear, then it must be the application not sending to AIX. However , the application also say that it is not possible because the entry appear at their log which is a local file. Is there anyway to perform further problem determination?