[syslog-ng] Disk buffer file truncation issue

[SZIGETVÁRI János]

AFAIK, file size truncation only happens when the "read head" of the disk
queue file catches up to the "write head".
So it is considered to be normal behavior to have a multi-gigabyte disk
queue file (if it is still below the maximum allowed size, set in the
configuration) that only has a few kilobytes of meaningful (as in actual
data that needs to be buffered at the moment) data in it.
If the queue file becomes empty (the read head becomes equal to the write
head) then (or at the next restart at the latest) the file will be
truncated.

Best Regards,
János
--
Janos SZIGETVARI
RHCE, License no. 150-053-692
<https://www.redhat.com/rhtapps/verify/?certId=150-053-692>

LinkedIn: linkedin.com/in/janosszigetvari

__ at __˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp


Fabien Wernli <wernli at in2p3.fr> ezt írta (időpont: 2020. jún. 15., H,
10:06):

> Hi,
>
> On Sat, Jun 13, 2020 at 09:09:25PM +0530, Raghunath Adhyapak wrote:
> > - The buffer file keeps increasing in size.
>
> I'm pretty sure this isn't normal behaviour.
> If the queue is short (as reported by `syslog-ng-ctl stats`) the file size
> should be close to zero.
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200615/e7062587/attachment-0001.html>