[syslog-ng] Disk based queuing with rsyslog?

[Delon Lee Di Lun]

Hi all,

Thank you for the time in commenting.

I understand that this is a syslog-ng mailling list but however, in my
setup I am testing. I have to use rsyslog for the client.

Has anybody tried a client as rsyslog and the server as syslog-ng does the
flow-control still kick in? Assume transportation protocol is TCP.

I want to see if anybody tried it before, or let me know its impossible
before i commit my time into testing the setup.

My intention is to leverage as much of the new features in syslog-ng as I
am testing the new setup. Need the setup to "sell".

Yours Sincerely,
Delon Lee

On Wed, 9 May 2018 at 20:01 PÁSZTOR György <pasztor at linux.gyakg.u-szeged.hu>
wrote:

> Hi,
>
> "Gergely Nagy" <algernon at balabit.com> írta 2018-05-09 12:35-kor:
> > >>>>> "Delon" == Delon Lee Di Lun <lee.delon2005 at gmail.com> writes:
> >
> >     Delon> However, now. I see the documentation mention that flow
> control can be used
> >     Delon> in conjunction with disk based buffering. How does flow
> control plays a
> >     Delon> part?
> >
> > The documentation has a chapter on flow-control, which explains the
> > purpose, and the behaviour of it:
> >
> https://syslog-ng.com/documents/html/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/concepts-flow-control.html
> >
> >     Delon> Flow control only works within the syslog-ng application?
> From the source
> >     Delon> to dest? Or it has the capability to detect the flow rate
> from the remote
> >     Delon> syslog-ng client and can "command" the syslog-ng client to
> slow down if the
> >     Delon> syslog-ng server cannot handle the load?
> >
> > Yes, it only works within a single syslog-ng instance. But if you have
> > syslog-ng on both client and server, if flow-control kicks in on the
> > server, and it slows down accepting messages, then flow-control will
> > also kick in on the client (because it detects that messages are not
> > going out fast enough), and it will start buffering (to disk too, if so
> > configured). This way, you'll only lose messages if all queues fill up.
>
> One extra thought to extend algernon's comment: to work this properly, you
> must use tcp. If you use udp, the client will not have proper feedback if
> the server couldn't process a message. In that case kernel's udp buffer
> just silently drop the message.
> In case of tcp: if the server process doesn't read (fast enough) from the
> socket, then the underlying kernel won't send back the tcp acknowledments.
>
> Cheers,
> Gyu
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180509/a8c5de68/attachment.html>