[syslog-ng] disk based buffering
thejaguar at tutanota.de
thejaguar at tutanota.de
Tue Sep 27 20:35:24 CEST 2016
Hi,I have been using disk based buffering with reliable turned on yes as suggested here :-https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-diskbuffer-reliable.html
This has been working great for me on an embedded linux device which does not have internet connection except when the application running on it turns on the modem/pppd when it has to send some data, basically to save battery power. Now syslog-ng is brilliant and sends all the stored/queued logs immediately upon detecting network connection as long as system stays alive. Now the challenge is if the device has a system reset or kernel crash in between network connection availability, will syslog-ng send unsent logs upon next system reboot when it gets the network connection ? Or it resets the queue and tracking upon system reset/boot ?I noticed any logs generated in between power resets and which are not sent are not transmitted on next net connection. Is it expected behaviour ? If not then what wrong I am doing ? also how can I read whats in /var/lib/syslog-ng/syslog-ng-00000.rqf or syslog-ng.persist ?
=======================
destination d_net { network ( "`myloghost`" port(`mylogport`) transport("tls") tls( ca-dir("/etc/syslog-ng/ca") peer-verify(required-trusted) ssl-options(no-sslv3,no-tlsv1) ) disk-buffer( reliable(yes) mem-buf-size(1M) disk-buf-size(5M) qout-size(64) ) template("<$PRI> $FACILITY $ISODATE $HOST $PROGRAM $MSG\n") );};
syslog-ng 3.8.1Installer-Version: 3.8.1Revision:Module-Directory: /usr/lib/syslog-ngModule-Path: /usr/lib/syslog-ngAvailable-Modules: cef,affile,basicfuncs,system-source,cryptofuncs,graphite,pseudofile,afuser,kvformat,add-contextual-data,date,csvparser,linux-kmsg-format,confgen,syslogformat,afprog,disk-buffer,dbparser,afsotEnable-Debug: offEnable-GProf: offEnable-Memtrace: offEnable-IPv6: offEnable-Spoof-Source: offEnable-TCP-Wrapper: offEnable-Linux-Caps: off
=======================
Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160927/d4a0852d/attachment.htm
More information about the syslog-ng
mailing list