We are working on an AWS deployment. We are planning on setting up 4 heavy forwarders with a few hundred universal forwarders and syslog devices connected in each DC to connect to AWS. I am trying to figure out what would happen if the connection from our DC to AWS is down for a long period of time. How will the heavy forwarders react? Everything that I have read is it will use up the memory until the maxQueueSize is met. With the HFs having disk storage attached, is there a way to have the data buffered on the disk, and if so, how will that be stored, block or file? Additionally, if the data cannot be buffered on the HF disk, how do the UFs react when the HF maxQueueSize is met?
↧