[syslog-ng]Message retension period

Jim Mozley syslog-ng@lists.balabit.hu
Fri, 17 Sep 2004 09:31:05 +0100


Balazs Scheidler wrote:
> On Thu, 2004-09-16 at 18:00, Jim Mozley wrote:
> 
>>Balazs Scheidler wrote:
>>
>>
>>
>>>syslog-ng keeps those messages in a memory buffer, whose size is
>>>controlled using the log_fifo_size() global/per-destination parameter.
>>
>>
>>I can do this on a global level but if I try:
>>
>>destination loghost { tcp("loghost" port(5140)); log_fifo_size(1000); };
>>
>>The documentation showed log_fifo_size applicable to a file destination 
>>but does not list it under udp and tcp destinations.
> 
> 
> Hmm I can't remember whether it is applicable to tcp destinations but
> the syntax you used above is not correct. it should be:
> 
> destination loghost { tcp("loghost" port(5140) log_fifo_size(1000)); };
> 

Just tried:

destination loghost { tcp("loghost" port(5140) log_fifo_size(1000)); };

Syslog-ng reports a parse error reading the configuration file, so I'm 
assuming this option is not supported for a tcp destination (or if it is 
it's taken from the global option).

So I guess I'm back to my original question of finding out what the 
limitation is on how long/how many messages are kept for a tcp 
destination that is unreachable.

As I understand it so far messages are kept indefinately in the buffer 
until its full, at which point incoming messages are dropped. So if 
log_fifo_size is only applicable to file destinations, then I would like 
to find out how to control the buffer size for tcp destinations (or at 
least be aware of its limitations).

Jim Mozley