This section describes how to get information about disk-buffer files used in syslog-ng Premium Edition (syslog-ng PE).
NOTE: While reading this section, consider that the default installation path used in the commands and syslog-ng PE files is /opt/syslog-ng.
Topics:
This section describes information about disk-buffer files used in syslog-ng Premium Edition (syslog-ng PE).
The following list contains information about how disk-buffer files are used in syslog-ng PE:
-
You can configure disk-buffer() for a remote destination in the destination() statement.
For more information about an example of configuring disk-buffer() for a remote destination in the destination() statement, see disk-buffer().
- By default, syslog-ng PE creates disk-buffer files under /opt/syslog-ng/var directory, unless dir() option is set in disk-buffer().
- The filenames are generated automatically by syslog-ng PE with the extensions .qf for a normal disk-buffer and .rqf for a reliable disk-buffer.
- The disk-buffer file stores processed log messages in the format in which they would have been sent out to the destination, but doesn't store information about the destination.
This section describes getting the list of disk-buffer files used in syslog-ng Premium Edition(syslog-ng PE).
The syslog-ng PE application stores information (namely, the IP:PORT or DNS:PORT of the destinations, and the name of the disk-buffer file) about disk-buffer files in its persist file.
Example: command for listing the disk-buffer files in use
The following command will list the disk-buffer files in use:
/opt/syslog-ng/bin/persist-tool dump /opt/syslog-ng/var/syslog-ng.persist | awk -F '["=]' '/(qfile\(|\.queue)/ { gsub(/[ \t]+/, "", $5); gsub(/^[0-9A-Fa-f]{8}/, "", $5); "echo "$5"|xxd -r -p"|& getline QUEUE; printf("%s ==> %s\n",$1,QUEUE)}'
The example output will look like the following:
afsocket_dd_qfile(stream,10.21.10.20:601) ==> /opt/syslog-ng/var/syslog-ng-00000.rqf
NOTE: If you receive the following error message instead of the example output, install a vim-common package on your system:
xxd: command not found
This section describes getting the status information of the disk-buffer files used in syslog-ng Premium Edition (syslog-ng PE).
Command syntax
The basic command syntax for getting the status information of the disk-buffer files used in syslog-ng PE looks like the following:
/opt/syslog-ng/bin/dqtoolinfo DISK-BUFFER_FILE
Example commands
The following example commands describe how you can get the status information of two different types of disk-buffer files (namely, empty normal disk-buffer files, and non-empty reliable disk-buffer queue files).
Example commands for empty, normal disk-buffer files, and non-empty, reliable disk-buffer queue files
-
Empty, normal disk-buffer file
/opt/syslog-ng/bin/dqtool info /opt/syslog-ng/var/syslog-ng-00000.qf
Disk-buffer state loaded; filename='/opt/syslog-ng/var/syslog-ng-00000.qf', number_of_messages='0'
-
Non-empty, reliable disk-buffer queue file
/opt/syslog-ng/bin/dqtool info /opt/syslog-ng/var/syslog-ng-00000.rqf
Reliable disk-buffer state loaded; filename='/opt/syslog-ng/var/syslog-ng-00000.rqf', number_of_messages='10'
One-liner command to get the state of disk-buffer files in the default directory
You can use the following one-liner command to get the state of disk-buffer files in the default directory:
for qfile in /opt/syslog-ng/var/*.?(r)qf ; do /opt/syslog-ng/bin/dqtool info $qfile 2>&1 ; done
