10 Mar
2011
10 Mar
'11
3:33 p.m.
On Thu, 10 Mar 2011 09:21:56 +0100 Zoltán Pallagi <pzolee@balabit.hu> wrote:
If you use TCP, you can use flags(flow-control) in your server configuration. If the senders are also syslog-ng, you can use it on their configurations, too. flow-control will slow down (or block) receiving logs if syslog-ng cannot process (write out, forward and so on) the messages in time. It can prevent losing logs.
The one caveat with this approach seems to be that if you have multiple destinations, then all destinations will block until the one stalled destination is free. So for instance if the SQL destination is too slow, and you're also logging to a file, using flow-control may cause the file-based log to lose messages as well. John