[syslog-ng]Message retension period
Jim Mozley
syslog-ng@lists.balabit.hu
Fri, 17 Sep 2004 09:31:05 +0100
Balazs Scheidler wrote:
> On Thu, 2004-09-16 at 18:00, Jim Mozley wrote:
>
>>Balazs Scheidler wrote:
>>
>>
>>
>>>syslog-ng keeps those messages in a memory buffer, whose size is
>>>controlled using the log_fifo_size() global/per-destination parameter.
>>
>>
>>I can do this on a global level but if I try:
>>
>>destination loghost { tcp("loghost" port(5140)); log_fifo_size(1000); };
>>
>>The documentation showed log_fifo_size applicable to a file destination
>>but does not list it under udp and tcp destinations.
>
>
> Hmm I can't remember whether it is applicable to tcp destinations but
> the syntax you used above is not correct. it should be:
>
> destination loghost { tcp("loghost" port(5140) log_fifo_size(1000)); };
>
Just tried:
destination loghost { tcp("loghost" port(5140) log_fifo_size(1000)); };
Syslog-ng reports a parse error reading the configuration file, so I'm
assuming this option is not supported for a tcp destination (or if it is
it's taken from the global option).
So I guess I'm back to my original question of finding out what the
limitation is on how long/how many messages are kept for a tcp
destination that is unreachable.
As I understand it so far messages are kept indefinately in the buffer
until its full, at which point incoming messages are dropped. So if
log_fifo_size is only applicable to file destinations, then I would like
to find out how to control the buffer size for tcp destinations (or at
least be aware of its limitations).
Jim Mozley