[syslog-ng] syslog-ng buffer and reload

[Scot]

+1 (--process-old-queue) as a separate process or thread when reloaded.

On Tue, Mar 28, 2017 at 4:37 AM, Fabien Wernli <wernli at in2p3.fr> wrote:

> On Tue, Mar 28, 2017 at 10:19:39AM +0200, Budai, László wrote:
> > no, I like your idea :)
> > If it's not a problem to stop syslog-ng then drop some messages from the
> > diskqueue and then start syslog-ng.
>
> What about:
>
>     # disables queue but does not remove file
>     #   e.g. by doing `mv syslog-ng-00000.qf syslog-ng-00000.qf.disabled`
>     syslog-ng-ctl --mv-away-queue --reload
>
>     # syslog-ng continues immediately with an empty queue
>     #   so sysadmin has time to curate the queue file
>
>     # offline work on disabled queue file
>     syslog-ng --cli-mode [… do some queue filtering on
> syslog-ng-00000.qf.disabled…]
>
>     # now we're happy with old queue, tell running syslog-ng to process it
>     syslog-ng-ctl --process-old-queue=syslog-ng-00000.qf.disabled
>
> Would that be doable?
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170412/d8289a69/attachment-0001.html>