This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Does the Kiwi Syslog buffer with SQL Server

I've technically got a two part question here and I'm pretty new to Syslog in general.  Our Kiwi Syslog server forwards it's logs to a SQL Server and I've got to bring the SQL Server down for a consistency repair that I can't fix offline at the moment.  Here's my questions.

1.  Will the Syslog buffer store messages that it's unable to transmit to the SQL or will it only store messages it can't process quick enough in it's own database? Because I can't lose any logs so if that's an issue I'll have to build a second sql to transfer the logs to.

2.  The default buffer shows as 500,000 and my registry doesn't list anything so I must have the default set up.  If I want to push it all the way to 10M (since this VM has tons of CPU/RAM) will I need to restart Kiwi for the change to take effect or will it query the registry after a certain interval for changes?

  • wesley.cole, I spoke with Engineering and here are the details.

    wesley.cole wrote:

    1.  Will the Syslog buffer store messages that it's unable to transmit to the SQL or will it only store messages it can't process quick enough in it's own database? Because I can't lose any logs so if that's an issue I'll have to build a second sql to transfer the logs to.

    We can enable the database caching by adding a registry entry. The below help file link will help you to enable that feature.

    http://www.kiwisyslog.com/help/syslog/index.html?databaselogger_disabledata.htm

    Another option would be that you can use the Log to file action to avoid losing data. We recommending this option if the traffic is high and if the outage is likely more than few hours.


    wesley.cole wrote:

    2.  The default buffer shows as 500,000 and my registry doesn't list anything so I must have the default set up.  If I want to push it all the way to 10M (since this VM has tons of CPU/RAM) will I need to restart Kiwi for the change to take effect or will it query the registry after a certain interval for changes?

    Please see the below help file link, which will help you increase the message buffer by adding a registry entry.

    http://www.kiwisyslog.com/help/syslog/adv_reg_msg_buffer_size.htm

    Please Note: All manual registry changes must require a Kiwi Syslog Server Service Restart to reflect the changes.