[syslog-ng] Disk based queuing with rsyslog?

[Nagy, Gábor]

Disk buffering means you have a persistent buffer, so you can safely stop
syslog-ng without worry about loosing not sent log messages (not like with
the default memory buffer).
Buffering can be done anywhere and makes sense to do it everywhere where a
connection can be broken (network hosts, etc.).
If you use the reliable disk-buffer then log loss caused by a syslog-ng
crash is prevented.

I would recommend you the documentation of syslog-ng, it has more details:
https://syslog-ng.com/documents/html/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/concepts-diskbuffer.html

Regards,
Gabor

On Tue, May 8, 2018 at 3:50 AM, Delon Lee Di Lun <lee.delon2005 at gmail.com>
wrote:

> Hi!
>
> Let me clarify.
> The purpose of disk based buffering is to prevent the lost of logs due to
> what factors?
> It does prevent lost of logs due to restarting the syslog-ng right?
>
> Buffering is done on the syslog-ng server end right?
>
> Yours Sincerely,
> Delon Lee
>
>
> On Mon, 7 May 2018 at 23:18 Nagy, Gábor <gabor.nagy at balabit.com> wrote:
>
>> Hello Delon Lee!
>>
>> You don't need the client to be syslog-ng for *disk based buffering on
>> the host*, i.e. you only need syslog-ng where you would like to do the
>> buffering.
>> It should work with rsyslog as a client and syslog-ng as a host.
>>
>> Regards,
>> Gabor
>>
>> On Mon, May 7, 2018 at 5:02 PM, Delon Lee Di Lun <lee.delon2005 at gmail.com
>> > wrote:
>>
>>> Hi,
>>>
>>> I read that syslog-ng can be setup to use disk based with flow control
>>> with the client to prevent lost of logs.
>>>
>>> However I was just thinking, how does this mechanism works? Does the
>>> client have to be using syslog-ng? Will it work if the client is using
>>> rsyslog? Native appliance that purely support syslog?
>>>
>>> Yours Sincerely,
>>> Delon Lee
>>>
>>> ____________________________________________________________
>>> __________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation: http://www.balabit.com/support/documentation/?
>>> product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
>>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?
>> product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180508/cc641294/attachment-0001.html>