Just to want clear something: I test right now stopping the syslog-ng server and inside the syslog-ng client log appear the following messages: " .... Nov 13 14:29:20 ubuntui38600.cujae.edu.cu syslog-ng[4889]: Connection failed; error='Connection refused (111)', time_reopen='10' Nov 13 14:29:30 ubuntui38600.cujae.edu.cu syslog-ng[4889]: Connection failed; error='Connection refused (111)', time_reopen='10' .... " with the server stopped, I hit some pages and apache generate messages to its the logs, then I start the syslog-ng server and the client sent to it all the pending messages, so the problem that I mention in my previous message about networking interruption and lost of messages don't exit, just remain the case when the syslog-ng client crash or die. Thanks and excuse me all these speech. Salute Frank Abel On Tue, 2007-11-13 at 14:18 -0500, Frank Abel Cancio Bello wrote:

Hi all!

What can I do to avoid that when I stop my syslog-ng client and apache server still logging to its files not lost all those messages? I mean, in the time that the syslog-ng client was not running, the apache continue working and logging data, but when I start the syslog client it don't send to the syslog-ng server the messages that apache logging when it was stopped.

Here is part of what I think relevant of my configuration file:

# apache message source source s_apache { # Apache2 access log source. file("/var/log/apache2/access.log" log_prefix("apache_access: ") follow_freq(1) flags(no-parse) );

# Apache2 access log source. file("/var/log/apache2/error.log" log_prefix("apache_error: ") follow_freq(1) flags(no-parse) ); };

# central log server destination d_tcp { tcp("10.8.2.227" port(514)); };

# apache logs to central server. log { source(s_apache); destination(d_tcp); flags(flow-control); };

All work fine, just worry about the lost of messages in case that the communication with syslog-ng server fail. I know that Premium Edition have the log_disk_fifo_size(), but that is the only way of do this? Nobody have a workaround for this so necessary feature using the Open Source Edition?

Salute Frank Abel

__________________________________________

Participe en Universidad 2008. 11 al 15 de febrero del 2008. Palacio de las Convenciones, Ciudad de la Habana, Cuba http://www.universidad2008.cu _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

__________________________________________ Participe en Universidad 2008. 11 al 15 de febrero del 2008. Palacio de las Convenciones, Ciudad de la Habana, Cuba http://www.universidad2008.cu