I am on designing a central log system in order to "concentrate" gigabytes (~12 daily) of logs from 3 delocalized platforms. Quickly here is how it works. I have 3 sites on which approximately 100 hosts push syslog messages to local relay over udp. My 3 relays just forward over tcp the syslog messages to a centralhost using syslog-ng. On my concentrator (centralhost) I receive and store those messages using syslog-ng. I have the configuration running in a lab with no problem. But what happens in case the concentrator fails (f.o. hardware pb) : Will the relays keep the messages somewhere ? can this be set up someway ? At this time I did not success in programming a fifo to have the messages written in case the network forward could not be done. Anybody did ? thanks, loïc spindler