[syslog-ng] Problems with syslog-ng

[Jain, Vaibhav (GE Healthcare)]

Hi,

Thanks for your quick response.

As per my understaning the buffering facility is only supported in the
premium version but I am using the Open source verison that's why I
asked these questions.

Does syslog-ng open source supports the buffering facility for log
messages ? If syslog-ng server is down then does syslog-ng client
buffers the log message? What it the maximum limit of buffer size and
how to set it in syslog-ng open source configuration file? Is it
log_fifo_size() ?


I am using the following code in logrotate.d file to send the HUP signal
to syslog-ng. Let me know this is correct way to send the HUP signal to
syslog-ng or not ? Do I need to add any configuration in syslog-ng ? Is
there any chance to loss the data? 

/var/log/*.log {
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd-ng.pid 2> /dev/null` 2>
/dev/null ||
true
    endscript
}



Regards,
VJ 

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Sandor Geller
Sent: Wednesday, September 02, 2009 7:24 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Problems with syslog-ng

Hi,

On Wed, Sep 2, 2009 at 5:46 AM, Jain, Vaibhav (GE
Healthcare)<Vaibhav.Jain at ge.com> wrote:
> Hello,
>
> Can anybody help me ? This is the first time I am not getting any 
> response from this forum. Please help!

Don't get this wrong but your questions were too generic. syslog-ng uses
internal buffering for logs so when there is a problem with a
destination then syslog-ng keeps messages in the buffer. When the buffer
gets overrun then syslog-ng starts dropping old messages.

syslog-ng OSE doesn't deal with log rotation on its own. It just opens a
"file" and then uses the given fd. It doesn't try to close and reopen
destinations as long as writes succeed. So If you rename the file and/or
create another with the same name then syslog-ng won't notice it and
will happily write to the same fd, just like unix apps usually do. It's
a common practice to send a HUP signal to the syslog daemon when log
rotation occured.

hth,

Sandor
________________________________________________________________________
______
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html