On Wed, Sep 28, 2016 at 03:02:19AM +0200, thejaguar@tutanota.de wrote:
So with dqtool ( cool) I noticed that actual problem is that syslog-ng is not writing to disk queue immediately when a message is generated. The message goes to usual place like var/log/message etc but not in the queue where it should because it has not been transmitted to remote host. Now I am thinking there has to be a memory limit before it starts flushing/dumping unsent message to disk queue ? I tried mem-buf-size(1) and log-fifo-size(1) but none of them works. Is it a static value or is it configurable ?
If I'm not mistaken the message will go to the destination's memory queue first; if the latter is full, only then will it make it to the diskq. You can check the status of the queue using the control socket (syslog-ng-ctl stats)