[syslog-ng] Syslog-ng OSE Question.

[Gergely Nagy]

"Malkin, Vlad" <Vlad.Malkin at viasat.com> writes:

> Is it possible to have syslog-ng client to invoke an external (to it)
> software to acknowledge when each individual log statement is sent to
> the server?

No, it's not possible to do that, but read below.

> Background: logs should not be lost. The system needs to store logs
> internally until they are transmitted to the server (use of TCP
> transport provides a level of reliable delivery). After each log
> statement is transmitted by syslog-ng client, it needs to be removed
> from internal store to preserve allocated space.

This is something that syslog-ng PE can do for you (albeit still not
allowing you to use an external program for ACKing) by way of its RLTP
protocol and disk buffering.

Other than that, using something like AMQP with durability and
persistance on would be closest to what you want, but that still allows
a narrow window where messages can get lost.

-- 
|8]