[syslog-ng]Could offline-mode be done with TCP option?

[Jason Haar]

Hi there

We're running a multi-country network of syslog-ng with centralized logging
(via TCP).

However, due to the possibility of network failure, I am not willing to rely
on the central server for triggering alerts - so we do that on the actual
leaf syslog servers instead. However, it would be much better if we could
actually centralize our alerting system (due to what we are alerting about).

So I was wondering if syslog-ng's TCP transport layer could be turned into
something like MySQL's master-slave mode: write to a cache file first, then
write to remote server, and if that succeeds, remove from cache file. 

That way if a network outage occurred, the cache file would just get larger
and larger, then when the network came up again, it would flow through
without any records being lost.

[I know the fifo option allows this in RAM - I guess all that I'm wondering
about is could that be done on disk instead?. A cache file would survive
restarts/etc.]

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1