From 41fab070b4a12d8b80328444149c7fde2d0feaf8 Mon Sep 17 00:00:00 2001 From: "William E. T. III" Date: Mon, 6 Apr 2020 19:09:13 -0400 Subject: [PATCH] Update splunk_hec.conf.tmpl Added dir argument to disk buffer in splunk_hec_conf.tmpl This change adds code to look for the SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR environmental variable and if present, it uses that directory for the directory of the disk buffer. The dir() option allows you to change the directory used for disk buffers. For 3.16 the feature is document at https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/disk-buffer The caveat is if you have already encountered disk buffering, there will be a persist file in the previous location (default /var/lib/syslog-ng) and that persist file will prevent syslog-ng from sucessfully using the new location. --- package/etc/conf.d/destinations/splunk_hec.conf.tmpl | 3 +++ 1 file changed, 3 insertions(+) diff --git a/package/etc/conf.d/destinations/splunk_hec.conf.tmpl b/package/etc/conf.d/destinations/splunk_hec.conf.tmpl index 463cba1..65f8dfc 100644 --- a/package/etc/conf.d/destinations/splunk_hec.conf.tmpl +++ b/package/etc/conf.d/destinations/splunk_hec.conf.tmpl @@ -26,6 +26,9 @@ destination d_hec { mem-buf-length({{conv.ToInt64 (math.Round ( math.Div (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH" "15000") (getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10")))}}) reliable(no) {{- end}} + {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR") ""}} + dir("{{- getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR"}}") + {{- end}} disk-buf-size({{conv.ToInt64 (math.Round ( math.Div (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE" "53687091200") (getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10")))}}) ) {{- end}}