Arh. I see. So its a setting I need to enable on the client syslog-ng configuration file. I was wonder what magical thing syslog-ng employ that automatically does the buffering when its enabled on the server side of configuration file.

However, now. I see the documentation mention that flow control can be used in conjunction with disk based buffering. How does flow control plays a part? 

Flow control only works within the syslog-ng application? From the source to dest? Or it has the capability to detect the flow rate from the remote syslog-ng client and can "command" the syslog-ng client to slow down if the syslog-ng server cannot handle the load?

Yours Sincerely,
Delon Lee

On Tue, 8 May 2018 at 15:32 Nagy, Gábor <gabor.nagy@balabit.com> wrote:
Disk buffering means you have a persistent buffer, so you can safely stop syslog-ng without worry about loosing not sent log messages (not like with the default memory buffer).
Buffering can be done anywhere and makes sense to do it everywhere where a connection can be broken (network hosts, etc.).
If you use the reliable disk-buffer then log loss caused by a syslog-ng crash is prevented.

I would recommend you the documentation of syslog-ng, it has more details:
https://syslog-ng.com/documents/html/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/concepts-diskbuffer.html

Regards,
Gabor

On Tue, May 8, 2018 at 3:50 AM, Delon Lee Di Lun <lee.delon2005@gmail.com> wrote:
Hi!

Let me clarify.
The purpose of disk based buffering is to prevent the lost of logs due to what factors? 
It does prevent lost of logs due to restarting the syslog-ng right? 

Buffering is done on the syslog-ng server end right?

Yours Sincerely,
Delon Lee


On Mon, 7 May 2018 at 23:18 Nagy, Gábor <gabor.nagy@balabit.com> wrote:
Hello Delon Lee!

You don't need the client to be syslog-ng for disk based buffering on the host, i.e. you only need syslog-ng where you would like to do the buffering.
It should work with rsyslog as a client and syslog-ng as a host.

Regards,
Gabor

On Mon, May 7, 2018 at 5:02 PM, Delon Lee Di Lun <lee.delon2005@gmail.com> wrote:
Hi, 

I read that syslog-ng can be setup to use disk based with flow control with the client to prevent lost of logs. 

However I was just thinking, how does this mechanism works? Does the client have to be using syslog-ng? Will it work if the client is using rsyslog? Native appliance that purely support syslog? 

Yours Sincerely,
Delon Lee

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq



______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq



______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq