I was looking into getting syslog-ng statistics into a nice cacti graph. In version 2x of syslog-ng there is some nice output with counters for each of the destinations and sources.

Most of this explains itself, but I'm not sure what the difference is between the two main counters:

On a lightly used syslog-ng system, the number of queued and received always match up. On this heavily used system the number queued and received are way off. It LOOKS like that I'm queuing up messages faster than I can process them. Does anyone know for certain if that's what is going on?