28 Feb
2005
28 Feb
'05
2:27 p.m.
How exactly does that work? You can only "stop writing" for so long, before a buffer fills up and you have to drop messages... On Mon, 28 Feb 2005 09:53:16 +0100, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2005-02-28 at 01:14 -0500, Jay Guerette wrote:
They're dropped, lost, unrecoverable. There really is nothing else syslog-ng could do in those situations.
If your data is that important (and who logs un-important stuff, anyway?) you should write it to a log file, and the parse it from there; that way, if your parser dies, you don't lose any data.
This is not necessarily true for syslog-ng 1.9.x where you can specify flags(flow-control) for log statements which means to stop writing instead of dropping messages.