[syslog-ng] Disregard source if it fails

[Faine, Mark R. (MSFC-IS40)[NICS]]

Excellent!  This is very helpful.  Thank you

-Mark


-----Original Message-----
From: László Várady (lvarady) <Laszlo.Varady at oneidentity.com> 
Sent: Saturday, September 21, 2019 09:10
To: Faine, Mark R. (MSFC-IS40)[NICS] <mark.faine at nasa.gov>
Cc: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: [EXTERNAL] Re: Disregard source if it fails

Hello,

> Is there a way to disable those servers, either temporarily or until restarted if we can't connect?

You can remove those destinations from their log paths and reload syslog-ng.

But the origin of your problem is coming from flow-control, if I understand you correctly.
When `flags(flow-control)` is used in a log path, the sources inside that log path will stop receiving messages when any of the attached destinations are slow or unavailable (after they fetched log-iw-size() number of messages that remained unsent in the destinations' queue).

If you don't mind losing messages on those 2 destinations in case they are slower than the sources or when they go down, you can create a separate log path for those destinations, where you do not enable flow control. This way, syslog-ng queues log-fifo-size() number of messages in memory for you. If memory queues are full, syslog-ng will drop new messages without stopping the source; so message processing won't stop.
Alternatively, you can configure a disk-buffer() if you need to survive longer without losing logs.

--
László Várady