[syslog-ng]Reliable syslog and network outages

[Roland Turner]

Amodiovalerio Verde wrote:

> Syslog-ng keep the undelievarable messages in internal queue ( memory )
> 
> (Naturally when you reboot your syslog-ng machine you lost all the queue)

This is pretty much what I feared.

<snip>

> I can assure that syslog-ng handles load of thousands of message for second
> ( i tried up to 15000 ), and the queue works
> really good when you've some program destinations that are slower than a
> burst of messages.

Ah, it sounds as though you've implemented the FIFO/buffer as a 
performance feature rather than as a high-availability one.

Is there any straightforward way to build a relay out of syslog-ng that 
offers reliable[1] forwarding of syslog information?

If not, would syslog-ng be interested in accepting a patch which added 
an option to make the FIFO buffer persistent?

- Raz



1: Clearly, perfect reliability is impossible; if a machine containing 
queued logs is physically destroyed before it gets the opportunity to 
deliver its logs, then they really will be lost. I am interested in 
reliability with respect to a temporary loss of connectivity between 
syslog relay and syslog collector, and a reboot of the relay during that 
loss of connectivity. The degree of reliability that I have in mind is 
comparable to that which I would expect of a mail relay; I certainly 
wouldn't want it throwing data away because of a reboot, but I'd accept 
data loss caused by physical destruction of the machine.