[syslog-ng] Disk buffer getting wiped out

László Várady (lvarady) Laszlo.Varady at oneidentity.com
Mon May 11 12:23:27 UTC 2020

Hello Raghu,

> 1. Does syslog-ng allocate buffers on disk as much as required and in small chunks? Or will it try to allocate all of the specified buffer at one (in this case 50GB)?

The disk space for disk buffers is allocated gradually first, only the amount needed.

> 2. Why couldn't syslog-ng resume operations after partition was freed up and destination was available?

That might be a bug. Once a destination becomes available (set time-reopen() to a lower value to check more frequently), syslog-ng should send messages out from the disk buffer.
Could you reproduce this issue and share the reproduction steps?

> 3. Why did all buffer files get deleted, after a restart

What do you mean by getting deleted? syslog-ng does not remove disk buffer files completely, but it may rename corrupt buffers, for example.

László Várady
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200511/8849c554/attachment.html>

More information about the syslog-ng mailing list