[syslog-ng] syslog-ng buffer and reload
scotrn at gmail.com
Thu Apr 13 03:00:33 UTC 2017
+1 (--process-old-queue) as a separate process or thread when reloaded.
On Tue, Mar 28, 2017 at 4:37 AM, Fabien Wernli <wernli at in2p3.fr> wrote:
> On Tue, Mar 28, 2017 at 10:19:39AM +0200, Budai, László wrote:
> > no, I like your idea :)
> > If it's not a problem to stop syslog-ng then drop some messages from the
> > diskqueue and then start syslog-ng.
> What about:
> # disables queue but does not remove file
> # e.g. by doing `mv syslog-ng-00000.qf syslog-ng-00000.qf.disabled`
> syslog-ng-ctl --mv-away-queue --reload
> # syslog-ng continues immediately with an empty queue
> # so sysadmin has time to curate the queue file
> # offline work on disabled queue file
> syslog-ng --cli-mode [… do some queue filtering on
> # now we're happy with old queue, tell running syslog-ng to process it
> syslog-ng-ctl --process-old-queue=syslog-ng-00000.qf.disabled
> Would that be doable?
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng