AFAIK, file size truncation only happens when the "read head" of the disk queue file catches up to the "write head".
So it is considered to be normal behavior to have a multi-gigabyte disk queue file (if it is still below the maximum allowed size, set in the configuration) that only has a few kilobytes of meaningful (as in actual data that needs to be buffered at the moment) data in it.
If the queue file becomes empty (the read head becomes equal to the write head) then (or at the next restart at the latest) the file will be truncated.

Best Regards,
János
--
Janos SZIGETVARI
RHCE, License no. 150-053-692


__@__˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp


Fabien Wernli <wernli@in2p3.fr> ezt írta (időpont: 2020. jún. 15., H, 10:06):
Hi,

On Sat, Jun 13, 2020 at 09:09:25PM +0530, Raghunath Adhyapak wrote:
> - The buffer file keeps increasing in size.

I'm pretty sure this isn't normal behaviour.
If the queue is short (as reported by `syslog-ng-ctl stats`) the file size
should be close to zero.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq