Does Kiwi Syslog store messages in some buffer memory when the DB is not reachable?

We are running on KSS 9.8.1 which is integrated with MySQL DB 5.7 to log the syslog/trap messages. To connect KSS to MySQL DB, we are using ODBC 8.0 driver.

To understand the application behavior when connectivity is lost to DB, we broke the connectivity. There was no abnormality observed in the application w.r.t performance. We then proceeded to restore the connectivity after 3 days, and found that all the messages received during the period of disconnection are being pushed to DB in a sequence. Basically, there was 0% data loss. But how is this possible? Our server receives approximately 11 Million Messages in a day.

We have discussed this with SolarWinds tech support team (Case # - 01334304) and got a response saying, KSS does not have any mechanism to store the messages in any temporary/buffer memory.

Question:

  • Is kiwi storing every single message locally on the server before it is pushed to File, DB or Display? If yes, is this what helps in prevention of data loss when the connectivity is broken b/w app and DB?
  • What component could be storing the data when connectivity to DB is broken?
  • Is ODBC driver capable of doing any such thing?
  • Is there any service of Kiwi which prevents such data loss?

I would be really grateful to have this query addressed. Thank you in Advance

Parents
  • If you look at the bottom of the Kiwi Syslog Server console there are a couple of status items.  The first is a percentage; this is the amount of message buffer available.  The message buffer is a registry setting that defaults to 500000 log items.  It can be set as high as 10 million.  It is possible, but unlikely, that this was enough to hold the messages until your database was available again.

    If you increase the message buffer size make sure your server has enough memory to handle them.  Read the help on the topic - open Help Topics, at the bottom is 'Registry Settings for Kiwi Syslog Server'.  Open that topic and look for 'MsgBufferSize'.

Reply
  • If you look at the bottom of the Kiwi Syslog Server console there are a couple of status items.  The first is a percentage; this is the amount of message buffer available.  The message buffer is a registry setting that defaults to 500000 log items.  It can be set as high as 10 million.  It is possible, but unlikely, that this was enough to hold the messages until your database was available again.

    If you increase the message buffer size make sure your server has enough memory to handle them.  Read the help on the topic - open Help Topics, at the bottom is 'Registry Settings for Kiwi Syslog Server'.  Open that topic and look for 'MsgBufferSize'.

Children
No Data