[syslog-ng] Reliability of Remote logging via TCP/Syslog-NG

[Balazs Scheidler]

On Wed, 2005-06-15 at 03:59 -0700, Alf wrote:
> Hi Balas and guys,
> 
> --- Balazs Scheidler <bazsi at balabit.hu> wrote:
> > syslog-ng has a FIFO in memory where it stores messages. The contents of
> > this fifo is not persistent (as it is in memory), thus if you stop and
> > restart syslog-ng the contents of this fifo is lost. Another thing to
> > note is that if this FIFO becomes full, syslog-ng will start dropping
> > messages (which it reports using the STATS message).
>  So assuming FIFO doesnt become full, I can assume messages that failed to send
> will be requeued to be sent ? 

One other problem is that whenever the server shuts down the connection
the client drops a _single_ log message. This is not easy to fix, at
least not in the 1.6.x branch. See the mailing list archives for more
information. 

> 
> > you can manually control the fifo size using log_fifo_size() global and
> > per-destination option.
>  Does it affect perforamnce greatly if I increase the size ? (Not that I will,
> since my traffic will be low), or will it be just a memory usage hit thats all
> ?

it only increases memory usage.

-- 
Bazsi