<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>We are running syslog-ng 3.16.1 on Centos 7.4.1708 on a central<br>
logging host. We have a large (nearly 1,000) servers also running
the<br>
same version of syslog-ng on the same Centos release. The servers
are<br>
configured to log locally and also forward logs to the central
logging<br>
host. <br>
<br>
This morning we encountered a problem - syslog-ng was running on
the<br>
logging host, but was not processing incoming logs or locally<br>
generated ones. The servers forwarding to the central host did not<br>
write anything to their local log files, a small but significant<br>
portion of them had syslog crash, after which is was restarted by<br>
systemd, but still no logs were written until syslog-ng was
forcibly<br>
stopped on the central server and then restarted. <br>
<br>
Connections to the central server weren't failing in the sense of
TCP<br>
close or reset, but logs were accumulating on all the servers,<br>
including the central one, in the cache file for buffering logs.<br>
<br>
For our purposes, we need to have up-to-the moment logs available
on<br>
the individual servers, so an admin going in to troubleshoot on a<br>
server who only has console access still has recent logs to
consult if<br>
needed.<br>
<br>
Is there a way to tell syslog-ng to write local logs immediately
even<br>
if it's currently buffering logs for sending to a non-responsive<br>
remote server?<br>
<br>
</p>
</body>
</html>