The syslog-ng 3.0 Administrator Guide

To enable disk-based buffering, use the log_disk_fifo_size() parameter in the destination to set the size of the disk buffer in bytes. Note that this value applies to every destination separately; every destination will have its own diskbuffer file, even if the parameter is set as a global option. For details on how disk-based buffering works, see Section 2.14, “Using disk-based buffering”. Disk buffers can be used with tcp(), tcp6(), syslog() (when using the tcp or tls transport methods), and sql() destinations. The number of messages that the disk buffer can store depends on the size (length) of the actual messages. The maximum length of a message is limited by the log_msg_size() parameter, which is 8192 bytes by default.

The disk buffer is located under /opt/syslog-ng/var/ on every platform.

Example 3.46. Enabling disk-based buffering

The following example turns on disk-based buffering for the destination. The size of the disk buffer is 4 194 304 bytes (4 megabytes). In a worst-case situation, using the default value of the log_msg_size() parameter (8192 bytes), this disk buffer can store at least 512 messages. Typical log messages are about 300-500 bytes long, so a disk buffer of 4 megabytes can store over 8000 messages. Set the size of the disk buffer based on the average size and number of messages, and the longest estimated downtime of the server. destination d_tcp { tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); };