[syslog-ng] syslog-ng buffer and reload

Budai, László laszlo.budai at balabit.com
Tue Mar 28 08:19:39 UTC 2017


On Tue, Mar 28, 2017 at 9:17 AM, Fabien Wernli <wernli at in2p3.fr> wrote:

> Hi,
> On Tue, Mar 28, 2017 at 09:05:08AM +0200, Budai, László wrote:
> > your use case is a special one: you know that you won't need any of the
> > messages stored in the diskbuffer after a reload.
> True enough
> > Maybe a --clear-diskqueue/--start-with-empty-diskqueue switch to the
> reload
> > command could solve this issue. But with this option you will lose all
> your
> > messages that are stored in the diskqueue. What do you think?
> That would certainly be an improvement :-)
> What would be even better (maybe the "syslog-ng as a command line" could
> help) is to apply a filter to what shall be deleted:
>   --purge-queue --drop-from-queue-matching 'not message("spurious
> message");'

> but I fear I'm asking for too much ;-D
no, I like your idea :)
If it's not a problem to stop syslog-ng then drop some messages from the
diskqueue and then start syslog-ng.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170328/b06c8b57/attachment.html>

More information about the syslog-ng mailing list