[syslog-ng] Disk buffer getting wiped out

[Raghunath Adhyapak]

Hi,

We have syslog-ng forwarding logs to a remote system, with reliability
enabled and disk buffer size set to 50GB in the configuration. However, the
actual size of the partition is 30GB. We had overlooked the partition size
that resulted in this error.
When there is connection loss to remote device and partition gets filled to
100% due to syslog-ng disk buffer.
syslog-ng continues to run, but even after we free some space in partition
and destination is available, it doesn't push out logs to the destination.
We have to restart syslog-ng service. After restarting, we observe that all
buffer files are freed up immediately. These files were consuming about
20-30GB.

Syslog-ng version using :3.24

Below is disk buffer configuration:

mem-buf-size(10000)
disk-buf-size(53687091200)
reliable(yes)
dir(/syslog/buffer)

Questions:
1. Does syslog-ng allocate buffers on disk as much as required and in small
chunks? Or will it try to allocate all of the specified buffer at one (in
this case 50GB)?
2. Why couldn't syslog-ng resume operations after partition was freed up
and destination was available?
3. Why did all buffer files get deleted, after a restart

Thanks
Raghu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200508/6cb09599/attachment.html>