Hi, Thanks for your quick response. As per my understaning the buffering facility is only supported in the premium version but I am using the Open source verison that's why I asked these questions. Does syslog-ng open source supports the buffering facility for log messages ? If syslog-ng server is down then does syslog-ng client buffers the log message? What it the maximum limit of buffer size and how to set it in syslog-ng open source configuration file? Is it log_fifo_size() ? I am using the following code in logrotate.d file to send the HUP signal to syslog-ng. Let me know this is correct way to send the HUP signal to syslog-ng or not ? Do I need to add any configuration in syslog-ng ? Is there any chance to loss the data? /var/log/*.log { postrotate /bin/kill -HUP `cat /var/run/syslogd-ng.pid 2> /dev/null` 2> /dev/null || true endscript } Regards, VJ -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Wednesday, September 02, 2009 7:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Problems with syslog-ng Hi, On Wed, Sep 2, 2009 at 5:46 AM, Jain, Vaibhav (GE Healthcare)<Vaibhav.Jain@ge.com> wrote:
Hello,
Can anybody help me ? This is the first time I am not getting any response from this forum. Please help!
Don't get this wrong but your questions were too generic. syslog-ng uses internal buffering for logs so when there is a problem with a destination then syslog-ng keeps messages in the buffer. When the buffer gets overrun then syslog-ng starts dropping old messages. syslog-ng OSE doesn't deal with log rotation on its own. It just opens a "file" and then uses the given fd. It doesn't try to close and reopen destinations as long as writes succeed. So If you rename the file and/or create another with the same name then syslog-ng won't notice it and will happily write to the same fd, just like unix apps usually do. It's a common practice to send a HUP signal to the syslog daemon when log rotation occured. hth, Sandor ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html