2.14. Using disk-based buffering

The Premium Edition of syslog-ng stores messages on the local hard disk if the central log server or the network connection to the server becomes unavailable. The syslog-ng application automatically sends the stored messages to the server when the connection is reestablished. The disk buffer is used as a queue: when the connection to the server is reestablished, syslog-ng sends the messages to the server in the order they were received.

	Note
	Disk-based buffering can be used in conjunction with flow-control. See Section 2.13, “Managing incoming and outgoing messages with flow-control” for details.

Disk buffers can be used with tcp(), tcp6(), syslog() (when using the tcp or tls transport methods), and sql() destinations. Every such destination uses a separate disk buffer (similarly to the output buffers controlled by log_fifo_size()). The hard disk space is not pre-allocated, so ensure that there is always enough free space to store the disk buffers even when the disk buffers are full.

If syslog-ng is restarted (using the /etc/init.d/syslog-ng restart command), it automatically saves any unsent messages of the disk buffer and the output queue. After the restart, syslog-ng sends the saved messages to the server. In other words, the disk buffer is persistent.

The syslog-ng application handles outgoing messages the following way:

Figure 2.12. Handling outgoing messages in syslog-ng PE

Output queue: Messages from the output queue are sent to the target syslog-ng server. The syslog-ng application puts the outgoing messages directly into the output queue, unless the output queue is full. The output queue can hold 64 messages, this is a fixed value and cannot be modified.
Disk buffer: If the output queue is full and disk-buffering is enabled, syslog-ng puts the outgoing messages into the disk buffer of the destination. The disk buffer is enabled if the log_disk_fifo_size() parameter of the destination is larger than 0; the size of the disk buffer is specified in bytes.
Overflow queue: If the output queue is full and the disk buffer is disabled or full, syslog-ng puts the outgoing messages into the overflow queue of the destination. (The overflow queue is identical to the output buffer used by other destinations.) The log_fifo_size() parameter specifies the number of messages stored in the overflow queue. See also Section 2.13, “Managing incoming and outgoing messages with flow-control” for details on sizing the log_fifo_size() parameter.

Prev	Up	Next
2.13. Managing incoming and outgoing messages with flow-control	Home \| Contents	2.15. Licensing

The syslog-ng 3.0 Administrator Guide

Document version: Tenth
Release date: January 8, 2010
Latest version available at the BalaBit Documentation Page