Hi, as others have suggested, you can increase the log_fifo_size option, which will increase the memory queue of syslog-ng. Depending on the message rate, this can prevent losing messages if the consumer is down, but if anything happens to your syslog-ng server in the meantime, these messages will be lost. The commercial version of syslog-ng, syslog-ng Premium Edition can buffer the messages to the hard disk in such case to decrese the risk of losing messages. Robert On 11/19/2012 11:42 AM, Abhijeet R wrote:
Hi all,
In my setup, I send logs from all the servers to a central syslog server. This syslog-ng server also has a destination on a different port which is picked up by logstash's input block. (consider it just a consumer to those messages).
What if this consumer goes down? How big is the queue? Is that configurable? How do I make sure that none of the messages are missed for the time the consumer is down?