[syslog-ng] Reprocess disk buffer files

Aaron Daniel aaron.daniel at tapjoy.com
Tue Mar 20 23:05:53 CET 2012

In the LTS version of PE, we have some servers that have old disk-buffer files (var/*qf) still on disk, with the contents not sent to a central server.  Is there a way to force syslog-ng to re-process those, or do we have to manually process them ourselves? 

The files contain very old log entries that still need to be processed, and syslog-ng appears to be using a newer *.qf file for it's disk buffer.  When it does this, it's completely ignoring the old log entries so we have some gaps in our central processing system.

(Sorry if this has been asked before, google's not been my friend on this search...) 

Aaron Daniel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120320/2a9c56a1/attachment.htm 

More information about the syslog-ng mailing list