Voltar
-
Título
The value of "stored" statistic on the Syslog-ng Agent for Windows stays at zero 0 -
Descrição
When viewing Syslog-ng statics in the Windows Event Viewer the value of "stored" statistic on the Syslog-ng Agent stays at zero 0. -
Causa
Expected Behavior -
Resolução
This is expected behavior.
The stored statistic is equivalent to the queued statistic in version 7 of Syslog-ng PE.
This statistic is as follows:
The number of messages stored in the message queue of the destination driver, waiting to be sent to the destination.
This means these are the logs queued in the destination buffer waiting to be sent to the destination because the destination is either down and cannot receive the logs, or that the destination cannot receive logs quickly enough and thus, logs begin to buffer on the host sending the logs.
When using the Syslog-ng PE Agent for Windows, the Event Viewer within Windows acts as a natural "buffer" for logs, if the Agent cannot send logs the persist file will keep track of where it last left off and will pick back up where it last left off once it is able to send again.
Because of this reason, on the Syslog-ng Agent for Windows, the stat for stored will never be more than 0 because there is no buffer within the agent as we rely on the Windows Event Viewer to act as a natural buffer. T
The "processed" stat on the other hand is as follows:
The number of messages that successfully reached their destination driver. Note that this does not necessarily mean that the destination driver successfully delivered the messages (for example, written to disk or sent to a remote server).
Processed is the number of logs that have been sent out to the end destination successfully. This does not mean that the end destination received them successfully as there can be errors on the end destination, it simply means that the logs successfully left the host in question out towards the end destination.
This is the number to look at on the Agent to tell you how many logs have been processed through the destination driver and sent out over the network.
The stored/queued stat is specifically for logs stored in the destination buffer, whether that be the memory buffer (log-fifo-size) or the disk buffer (disk-buffer). This is so when polling the stats, we can see how many logs have queued up to be sent.