Hi Balazs,
Sorry, couldnt get back to you earlier. Below is a sample of config
destination d_msg_04 {
tcp(
"172.49.20.136"
port(2193)
# log-fifo-size should be atleast max-connections * log-fetch-limit
# 500 * 10 (default value of log-fetch-limit)
log-fifo-size(5000)
# throttle to max 5k logs
throttle(5000)
disk-buffer(
# number of bytes to store in memory
mem-buf-size(10000)
# number of bytes to store on disk
disk-buf-size(134217728000) # 100GB
reliable(yes)
# directory location to persist messages
dir("/data/store")
)
persist-name(d_msg_04)
);
};
The throttle value as you can see is set to 5000. Throttling is an important part of using syslog-ng for us here and it does a good job of it. The exception is when there is a backlog built up on syslog-ng (it received a lot more logs than it could push out honoring the throttle limit), and we stop or restart syslog-ng. At that time, it appears to be "flushing out" whatever messages it has in its buffer and disregard the throttle limit at this time. This is causing issues for us.
So, wanted to understand if there is a way to prevent this. Tried tinkering with the log-fifo-size thinking it may prevent too many messages in the buffer and there by help with this problem but it didnt help.
It would be great if you could help us with this.
Thanks !