On Wed, 2005-06-15 at 03:14 -0700, Alf wrote:
Hi Guys,
(New to this list, searched the FAQ for this qn, didnt find it. So I apologize if this was repeated before on the list. It might be related to the topic on TCP timingout though as report @ https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html)
I'm planning to deploy a syslog-ng setup. (Central logging server in Asia, and Clients will be in US/HK). The setup is actually as a backup/secure repository of log entries of the appliation we are running.
Now the question is, (I know TCP is reliable vs UDP), how reliable will syslog-ng hand the log entries ? If it gets disconnected (due to timeout, reset, etc), will it hold the log entry in memory and queue it for resend ? Is there an option to set before it times out (And at least logs it in a local log that there was an error (as an internal msg i guess)
syslog-ng has a FIFO in memory where it stores messages. The contents of this fifo is not persistent (as it is in memory), thus if you stop and restart syslog-ng the contents of this fifo is lost. Another thing to note is that if this FIFO becomes full, syslog-ng will start dropping messages (which it reports using the STATS message). you can manually control the fifo size using log_fifo_size() global and per-destination option. -- Bazsi