[syslog-ng] Prevent message loss while using tcp output

3 May 2013

      Hi all,

I've source defined as:

source s_sys {
        file ("/proc/kmsg" program_override("kernel: "));
        unix-stream ("/dev/log");
        internal();
        udp(ip(0.0.0.0) port(514));
};

And one of the destination as:

destination d_logstash { tcp( "127.0.0.1" port(515)
template(t_both_timestamps) flush_lines(10)); };

Problem is when my consumer is down, I can see messages being dropped
in "syslog-ng-ctl stats".

How can I avoid this at the expense of memory (like a queueing
mechanism or something)?

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com