[syslog-ng] Disk based queuing with rsyslog?
Delon Lee Di Lun
lee.delon2005 at gmail.com
Wed May 9 12:21:22 UTC 2018
Thank you for the time in commenting.
I understand that this is a syslog-ng mailling list but however, in my
setup I am testing. I have to use rsyslog for the client.
Has anybody tried a client as rsyslog and the server as syslog-ng does the
flow-control still kick in? Assume transportation protocol is TCP.
I want to see if anybody tried it before, or let me know its impossible
before i commit my time into testing the setup.
My intention is to leverage as much of the new features in syslog-ng as I
am testing the new setup. Need the setup to "sell".
On Wed, 9 May 2018 at 20:01 PÁSZTOR György <pasztor at linux.gyakg.u-szeged.hu>
> "Gergely Nagy" <algernon at balabit.com> írta 2018-05-09 12:35-kor:
> > >>>>> "Delon" == Delon Lee Di Lun <lee.delon2005 at gmail.com> writes:
> > Delon> However, now. I see the documentation mention that flow
> control can be used
> > Delon> in conjunction with disk based buffering. How does flow
> control plays a
> > Delon> part?
> > The documentation has a chapter on flow-control, which explains the
> > purpose, and the behaviour of it:
> > Delon> Flow control only works within the syslog-ng application?
> From the source
> > Delon> to dest? Or it has the capability to detect the flow rate
> from the remote
> > Delon> syslog-ng client and can "command" the syslog-ng client to
> slow down if the
> > Delon> syslog-ng server cannot handle the load?
> > Yes, it only works within a single syslog-ng instance. But if you have
> > syslog-ng on both client and server, if flow-control kicks in on the
> > server, and it slows down accepting messages, then flow-control will
> > also kick in on the client (because it detects that messages are not
> > going out fast enough), and it will start buffering (to disk too, if so
> > configured). This way, you'll only lose messages if all queues fill up.
> One extra thought to extend algernon's comment: to work this properly, you
> must use tcp. If you use udp, the client will not have proper feedback if
> the server couldn't process a message. In that case kernel's udp buffer
> just silently drop the message.
> In case of tcp: if the server process doesn't read (fast enough) from the
> socket, then the underlying kernel won't send back the tcp acknowledments.
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng