[syslog-ng] Disk based queuing with rsyslog?

[Delon Lee Di Lun]

Arh. I see. So its a setting I need to enable on the client syslog-ng
configuration file. I was wonder what magical thing syslog-ng employ that
automatically does the buffering when its enabled on the server side of
configuration file.

However, now. I see the documentation mention that flow control can be used
in conjunction with disk based buffering. How does flow control plays a
part?

Flow control only works within the syslog-ng application? From the source
to dest? Or it has the capability to detect the flow rate from the remote
syslog-ng client and can "command" the syslog-ng client to slow down if the
syslog-ng server cannot handle the load?

Yours Sincerely,
Delon Lee

On Tue, 8 May 2018 at 15:32 Nagy, Gábor <gabor.nagy at balabit.com> wrote:

> Disk buffering means you have a persistent buffer, so you can safely stop
> syslog-ng without worry about loosing not sent log messages (not like with
> the default memory buffer).
> Buffering can be done anywhere and makes sense to do it everywhere where a
> connection can be broken (network hosts, etc.).
> If you use the reliable disk-buffer then log loss caused by a syslog-ng
> crash is prevented.
>
> I would recommend you the documentation of syslog-ng, it has more details:
>
> https://syslog-ng.com/documents/html/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/concepts-diskbuffer.html
>
> Regards,
> Gabor
>
> On Tue, May 8, 2018 at 3:50 AM, Delon Lee Di Lun <lee.delon2005 at gmail.com>
> wrote:
>
>> Hi!
>>
>> Let me clarify.
>> The purpose of disk based buffering is to prevent the lost of logs due to
>> what factors?
>> It does prevent lost of logs due to restarting the syslog-ng right?
>>
>> Buffering is done on the syslog-ng server end right?
>>
>> Yours Sincerely,
>> Delon Lee
>>
>>
>> On Mon, 7 May 2018 at 23:18 Nagy, Gábor <gabor.nagy at balabit.com> wrote:
>>
>>> Hello Delon Lee!
>>>
>>> You don't need the client to be syslog-ng for *disk based buffering on
>>> the host*, i.e. you only need syslog-ng where you would like to do the
>>> buffering.
>>> It should work with rsyslog as a client and syslog-ng as a host.
>>>
>>> Regards,
>>> Gabor
>>>
>>> On Mon, May 7, 2018 at 5:02 PM, Delon Lee Di Lun <
>>> lee.delon2005 at gmail.com> wrote:
>>>
>>>> Hi,
>>>>
>>>> I read that syslog-ng can be setup to use disk based with flow control
>>>> with the client to prevent lost of logs.
>>>>
>>>> However I was just thinking, how does this mechanism works? Does the
>>>> client have to be using syslog-ng? Will it work if the client is using
>>>> rsyslog? Native appliance that purely support syslog?
>>>>
>>>> Yours Sincerely,
>>>> Delon Lee
>>>>
>>>>
>>>> ______________________________________________________________________________
>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>> Documentation:
>>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>
>>>>
>>>>
>>>
>>> ______________________________________________________________________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation:
>>> http://www.balabit.com/support/documentation/?product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
>> http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180508/c91b7163/attachment.html>