I have some offline systems that record their log files to /var/log/HOSTS/hostname/yyyy/mm/dd/, and I just have them resync to the central server when they can connect to it. The central server has /var/log/HOSTS/{host1,host2,host3...}, and rsync supports compression and rate limiting. Now, this isn't a live transfer, but it suffices for daily updates. Russell On Thu, Oct 28, 2004 at 02:51:31PM -0700, LEROY ISAAC wrote:

Thanks a lot for both of your suggestions. It is an assumption that QOS will be on the network link, but this still doesn't account for a continually backed up host trying to send data.

We are planning to utilize TCP as the transport. I figured TCP, QOS, and adjustments in the size of the log_fifo_size (num - The number of lines fitting to the output queue) might solve the issue.

It is my understanding that the log_fifo_size, which does not have flow control, can be used to buffer data bound for destinations (either local disk or remote). I might be wrong in this understanding.

I need the replay script to feed into the syslog data stream on the central syslog-ng server, since the central syslog-ng server feeds other applications.

LeRoy _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html