<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
<font size="-1"><font face="Helvetica, Arial, sans-serif">The
log_fifo_size variable controls how many messages the output buffer
will hold. So if server Z is relaying to A, and A goes down, Z will
start storing messages in this buffer. Unfortunately there is no way to
say 'if destination A fails, log to destination A2 (which may be a file
output or something) instead'. The premium version does support
disk-based buffering though, so that if log_fifo_size fills up, it'll
start writing out to a disk based file instead.</font></font><br>
<br>
Sent: Thursday, April 22, 2010 12:13:40 AM<br>
From: noel anderson <a class="moz-txt-link-rfc2396E" href="mailto:nascentcatalyst@yahoo.com"><nascentcatalyst@yahoo.com></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] Process stored logs
<blockquote cite="mid:86110.98751.qm@web94809.mail.in2.yahoo.com"
type="cite">
<pre wrap="">I'm building an infra across the geo's to collect logs at a central repository. I have set up syslog-ng in 3 geo's (say for e.g X, Y, Z) to collect logs form servers in respective Geo. A forurth server (say for eg. A) where the logs are forwarded from the 3 log servers to aggregate all the logs from all GEO's.
The problem where I fail to understand is, if my aggregator server (A) goes down, how do i process my stored logs on (X,) (Y), (Z), so that i do not loose any logs during my downtime.
Is it possible to process backlog of logs on the server or do i have to change my infra so that i do not loose these logs?
Thanks
Noel (hsxtrt)
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
</body>
</html>