Amodiovalerio Verde wrote:
Syslog-ng keep the undelievarable messages in internal queue ( memory )
(Naturally when you reboot your syslog-ng machine you lost all the queue)
This is pretty much what I feared. <snip>
I can assure that syslog-ng handles load of thousands of message for second ( i tried up to 15000 ), and the queue works really good when you've some program destinations that are slower than a burst of messages.
Ah, it sounds as though you've implemented the FIFO/buffer as a performance feature rather than as a high-availability one. Is there any straightforward way to build a relay out of syslog-ng that offers reliable[1] forwarding of syslog information? If not, would syslog-ng be interested in accepting a patch which added an option to make the FIFO buffer persistent? - Raz 1: Clearly, perfect reliability is impossible; if a machine containing queued logs is physically destroyed before it gets the opportunity to deliver its logs, then they really will be lost. I am interested in reliability with respect to a temporary loss of connectivity between syslog relay and syslog collector, and a reboot of the relay during that loss of connectivity. The degree of reliability that I have in mind is comparable to that which I would expect of a mail relay; I certainly wouldn't want it throwing data away because of a reboot, but I'd accept data loss caused by physical destruction of the machine.