VLC collect when nwlogcollector stop?

[ThomasGaultier]

Hello,

What is happening when we stop a few minutes and start or restart the nwlogcollector service ?

Do we loose logs? Does the VLC keep getting the log and buffer them?

Thanks,

[IslamRashad]

The Log Collection service makes use of Pivotal's RabbitMQ message queuing technology to satisfy a number of requirements. The Message Broker:

1- Provides asynchronous delivery of event data between components, even if not all components in the  system are running or available. This allows the Log Collector to continue collecting event data, even if the Log Decoder or other event consumers are unavailable. 

2- Provides persistence of event data on disk in the event of a machine restart or upgrade. Events are never lost in the case of graceful shutdown, and most events are be saved in the event of  catastrophic shutdown. 

3- Provides movement of event data from one node to the other via configuration, without the need for  additional code.

4- Provides a number of routing scenarios, supporting load balancing and replication.

5-  Provides mutually authenticated SSL between nodes, so that data can be confidentiality and integrity protected in motion, while also mutually authenticated.

In that essence, data availability is preserved in case of service/crashes or unplanned/planned restart.

Thanks,
Islam Rashad

[SravanKoneti1]

Hi Thomas,

When collector service stopped, all collection methods like windows, checkpoint, file.. (Except syslog) will create bookmarks. Using these bookmarks when collector service started the collection starts from where it stopped.

[ThomasGaultier]

Hi,

And thanks for the answers.

Except Syslog? You mean if I stopped the syslog message will be dropped?

[SravanKoneti1]

Hi Thomas,

Yes. Syslog collection will have log loss during collector service stop. 

[ThomasGaultier]

Hi,

Ok got it because we have to made changes on the VLC configuration and its seems that the only way to do it is to send the log to another VLC ?

And if we restart ? It will stop and start so we will loose logs ?

[SravanKoneti1]

Hi Thomas,

If syslog messages are critical for organisation, we can direct them to different collector before stopping collector service. So event source can send messages to the appropriate running collector.

[KamilGlowinski2]

For syslog the best option in this situation is VIP , which will balance syslog flow between 2 VLC.

You can do similar for sftp and snmp collection ( traps also will be lost when nwlogcollector service will be restarted)