<p dir="ltr">No, it resends everything it finds in the queue.</p>
<div class="gmail_extra"><br><div class="gmail_quote">On Sep 27, 2016 8:41 PM, <<a href="mailto:thejaguar@tutanota.de">thejaguar@tutanota.de</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<br>Thanks.<div>So if the queue stays intact, syslog-ng will try to send unsent messages as and when it starts ? even after 2-3 days ? it does not reset the queue or tracking ever ?</div><div><br></div><div>Thanks again</div><div><br></div><div><br></div><div>27. Sep 2016 12:11 by <a href="mailto:balazs.scheidler@balabit.com" rel="noopener noreferrer" target="_blank">balazs.scheidler@balabit.com</a>:<br><br><blockquote style="border-left:1px solid #93a3b8;padding-left:10px;margin-left:5px"><p>Syslog-ng attempts to address application level failures with reliable disk buffer but kernel level crashes/power failures are not covered, at least you can suffer message loss, but the queue in general should stay intact.</p>
<p>There's a tool for reading disk queue files, iirc the name is dqtool, should be included in your package.</p>
<div class="gmail_extra"><br><div class="gmail_quote">On Sep 27, 2016 8:35 PM, <<a href="mailto:thejaguar@tutanota.de" rel="noopener noreferrer" target="_blank">thejaguar@tutanota.de</a>> wrote:<br><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
Hi,<div>I have been using disk based buffering with reliable turned on yes as suggested here :-</div><div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-diskbuffer-reliable.html" rel="noopener noreferrer" target="_blank">https://www.balabit.com/<wbr>documents/syslog-ng-ose-<wbr>latest-guides/en/syslog-ng-<wbr>ose-guide-admin/html/<wbr>configuring-diskbuffer-<wbr>reliable.html</a><br></div><div><br></div><div>This has been working great for me on an embedded linux device which does not have internet connection except when the application running on it turns on the modem/pppd when it has to send some data, basically to save battery power. Now syslog-ng is brilliant and sends all the stored/queued logs immediately upon detecting network connection as long as system stays alive. Now the challenge is if the device has a system reset or kernel crash in between network connection availability, will syslog-ng send unsent logs upon next system reboot when it gets the network connection ? Or it resets the queue and tracking upon system reset/boot ?</div><div>I noticed any logs generated in between power resets and which are not sent are not transmitted on next net connection. Is it expected behaviour ? If not then what wrong I am doing ? also how can I read whats in /var/lib/syslog-ng/syslog-ng-<wbr>00000.rqf or syslog-ng.persist ?</div><div><br></div><div>=======================<br></div><div><br></div><div><div>destination d_net {</div><div> network (</div><div> "`myloghost`" port(`mylogport`) transport("tls")</div><div> tls( ca-dir("/etc/syslog-ng/ca") peer-verify(required-trusted) ssl-options(no-sslv3,no-tlsv1) )</div><div> disk-buffer( reliable(yes) mem-buf-size(1M) disk-buf-size(5M) qout-size(64) )</div><div> template("<$PRI> $FACILITY $ISODATE $HOST $PROGRAM $MSG\n")</div><div> );</div><div>};</div></div><div><br></div><div><div>syslog-ng 3.8.1</div><div>Installer-Version: 3.8.1</div><div>Revision:</div><div>Module-Directory: /usr/lib/syslog-ng</div><div>Module-Path: /usr/lib/syslog-ng</div><div>Available-Modules: cef,affile,basicfuncs,system-<wbr>source,cryptofuncs,graphite,<wbr>pseudofile,afuser,kvformat,<wbr>add-contextual-data,date,<wbr>csvparser,linux-kmsg-format,<wbr>confgen,syslogformat,afprog,<wbr>disk-buffer,dbparser,afsot</div><div>Enable-Debug: off</div><div>Enable-GProf: off</div><div>Enable-Memtrace: off</div><div>Enable-IPv6: off</div><div>Enable-Spoof-Source: off</div><div>Enable-TCP-Wrapper: off</div><div>Enable-Linux-Caps: off</div></div><div><br></div><div>=======================<br></div><div><br></div><div>Thanks</div><div><br></div><div><br></div> </div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noopener noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noopener noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noopener noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></blockquote></div> </div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div></div>