The syslog-ng Administrator GuideDocument version: 1.1.4
|
 |
The syslog-ng Administrator GuideDocument version: 1.1.4
|
|
The Premium Edition of syslog-ng stores messages on the local hard disk if the central log server or the network connection to the server becomes unavailable. The syslog-ng application automatically sends the stored messages to the server when the connection is reestablished. The disk buffer is used as a queue: when the connection to the server is reestablished, syslog-ng sends the messages to the server in the order they were received.
To enable disk-based buffering, use the log_disk_fifo_size()
parameter to set the size of the disk buffer in bytes. Disk buffers can be used only
with tcp() and tcp6() destinations. Every
such destination uses a separate disk buffer (similarly to the output buffers controlled
by log_fifo_size()). The hard disk space is not pre-allocated, so
ensure that there is always enough free space to store the disk buffers even when the
disk buffers are full.
If syslog-ng is restarted (using the /etc/init.d/syslog-ng restart command), it automatically saves any unsent messages of the disk buffer and the output queue. After the restart, syslog-ng sends the saved messages to the server. In other words, the disk buffer is persistent.
The syslog-ng application handles outgoing messages the following way:
Output queue: Messages from the output queue are sent to the target syslog-ng server. The syslog-ng application puts the outgoing messages directly into the output queue, unless the output queue is full. The output queue can hold 64 messages, this is a fixed value and cannot be modified.
Disk buffer: If the output queue is full and
disk-buffering is enabled, syslog-ng puts the outgoing messages into the disk
buffer of the destination. The disk buffer is enabled if the
log_disk_fifo_size() parameter of the destination is
larger than 0; the size of the disk buffer is specified
in bytes.
Overflow queue: If the output queue is full and the disk
buffer is disabled or full, syslog-ng puts the outgoing messages into the
overflow queue of the destination. (The overflow queue is identical to the
output buffer used by other destinations.) The
log_fifo_size() parameter specifies the number of
messages stored in the overflow queue. See also Section 8.3, “Managing incoming and outgoing messages with flow-control”
for details on sizing the log_fifo_size()
parameter.
The number of messages that the disk buffer can store depends on the size (length) of
the actual messages. The maximum length of a message is limited by the
log_msg_size() parameter, which is 8192 bytes by default.
![[Example]](./example.png) |
Example 8.2. Enabling disk-based buffering |
|---|---|
|
The following example turns on disk-based buffering for the destination. The size
of the disk buffer is 4 194 304 bytes (4 megabytes). In a worst-case situation,
using the default value of the
destination d_tcp {
tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };
|
© 2007-2008 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com