From 77aa4523b93438b0f3af07c82f703b54477c4a8d Mon Sep 17 00:00:00 2001 From: "William E. Triest III" Date: Tue, 7 Apr 2020 09:41:43 -0400 Subject: [PATCH] Documented SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR variable --- docs/configuration.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/configuration.md b/docs/configuration.md index d4e8af5..1a3a1bd 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -66,6 +66,11 @@ entire destination. Pay careful attention to this when using the "BYOE" version may hide this nuance. Lastly, be sure to factor in the syslog-ng data structure overhead (approx. 2x raw message size) when calculating the total buffer size needed. To determine the proper size of the disk buffer, consult the "Data Resilience" section below. +* NOTE: When changing the disk buffering directory, the new directory must exist. If it doesn't, then syslog-ng will fail to start. + +* NOTE: When changing the disk buffering directory, if buffering has previously occurd on that instance, a persist file may exist which will prevent syslog-ng from changing the directory. + + | Variable | Values/Default | Description | |----------|---------------|-------------| | SC4S_DEST_SPLUNK_HEC_DISKBUFF_ENABLE | yes(default) or no | Enable local disk buffering | @@ -73,6 +78,7 @@ total buffer size needed. To determine the proper size of the disk buffer, consu | SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFSIZE | bytes (10241024) | Memory buffer size in bytes (used with reliable disk buffering) | | SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH |messages (15000) | Memory buffer size in message count (used with normal disk buffering) | | SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE | bytes (53687091200) | size of local disk buffer in bytes (default 50 GB) | +| SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR | path | location to store the diskbuffering files | ## Archive File Configuration