[syslog-ng] Reliability of Remote logging via TCP/Syslog-NG

[Balazs Scheidler]

On Wed, 2005-06-15 at 03:14 -0700, Alf wrote:
> Hi Guys,
> 
>  (New to this list, searched the FAQ for this qn, didnt find it. So I apologize
> if this was repeated before on the list. It might be related to the topic on
> TCP timingout though as report @
> https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006974.html)
> 
>  I'm planning to deploy a syslog-ng setup. (Central logging server in Asia, and
> Clients will be in US/HK). The setup is actually as a backup/secure repository
> of log entries of the appliation we are running.
> 
>  Now the question is, (I know TCP is reliable vs UDP), how reliable will
> syslog-ng hand the log entries ? If it gets disconnected (due to timeout,
> reset, etc), will it hold the log entry in memory and queue it for resend ? Is
> there an option to set before it times out (And at least logs it in a local log
> that there was an error (as an internal msg i guess)

syslog-ng has a FIFO in memory where it stores messages. The contents of
this fifo is not persistent (as it is in memory), thus if you stop and
restart syslog-ng the contents of this fifo is lost. Another thing to
note is that if this FIFO becomes full, syslog-ng will start dropping
messages (which it reports using the STATS message).

you can manually control the fifo size using log_fifo_size() global and
per-destination option.

-- 
Bazsi