search

paleg / eventlog-to-syslog

Automatically exported from code.google.com/p/eventlog-to-syslog
3 stars 3 forks source link

Evtsys cache #13

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
Is possible to add the ability to keep the logs stored in cache in case of fail 
of the centralize syslog server?

Many thanks 

Roberto

Original issue reported on code.google.com by roberto....@gmail.com on 31 Aug 2010 at 5:37

GoogleCodeExporter commented 8 years ago 
Hi Roberto, thanks for your interest in the utility. Unfortunately I do not see 
any plans for this in the future. It would require some rewriting and overhead 
from the utility which I do not see a very good use case for. The reason I 
implemented the duplicate log server ability was so we could mitigate just such 
a problem.

Maintaining a separate cache would require file checking, specifying limits, 
memory and process overhead and kind of moves away from the simplicity I'm 
trying to maintain. Remember this was geared originally toward very busy 
servers, so I prefer to keep any utility processing to just what's required. 
Additionally, since I'm only using UDP currently there would be no way to 
determine whether a message arrived or not so the cache would be kept 
permanently.

What you could do in the event of a known syslog server failure is backup all 
of the windows logs to a remote machine so that you can maintain the remote 
backups. I can provide powershell scripts capable of doing this remotely if you 
like.

-Sherwin

Original comment by sherwin....@gmail.com on 10 Sep 2010 at 12:57