[syslog-ng]Message retension period

Balazs Scheidler syslog-ng@lists.balabit.hu
Thu, 16 Sep 2004 15:30:02 +0200

On Thu, 2004-09-16 at 13:48, Jim Mozley wrote:
> I have a remote server running syslog-ng collecting messages from 
> network devices that are local to it and transferring them to a central 
> server using TCP. This is to avoid messages being lost when UDP is used 
> a a network problem occurs. All works as it should and I have tested 
> breaking the link between the local collection station and the central 
> server; the messages are passed to the central server when the link is 
> restored.
> I had a question regarding how long the remote server will hold on to 
> the messages when it cannot pass them to the central server. Is this a 
> time dependent parameter, memory limit or hard coded somewhere? I 
> couldn't find a destination driver configuration parameter for this in 
> the documentation.

syslog-ng keeps those messages in a memory buffer, whose size is
controlled using the log_fifo_size() global/per-destination parameter.