[syslog-ng] Disk buffer getting wiped out

[László Várady (lvarady)]

Hello Raghu,

> 1. Does syslog-ng allocate buffers on disk as much as required and in small chunks? Or will it try to allocate all of the specified buffer at one (in this case 50GB)?

The disk space for disk buffers is allocated gradually first, only the amount needed.

> 2. Why couldn't syslog-ng resume operations after partition was freed up and destination was available?

That might be a bug. Once a destination becomes available (set time-reopen() to a lower value to check more frequently), syslog-ng should send messages out from the disk buffer.
Could you reproduce this issue and share the reproduction steps?

> 3. Why did all buffer files get deleted, after a restart

What do you mean by getting deleted? syslog-ng does not remove disk buffer files completely, but it may rename corrupt buffers, for example.

--
László Várady
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200511/8849c554/attachment.html>