Log server

Samhain
Prev | Chapter 4. Configuration of logging facilities | Next

# 4.6. Log server

Server address

  SetLogServer=`my.server.address`

  You have to specify the server address, unless it is already compiled in. It is possible to specify a second server that will be used as backup.

  | Note
  | If you want to store the configuration file on the server, the server address must be compiled in.

## 4.6.1. Details

During temporary connection failures, messages are stored in a FIFO queue in memory. The maximum number of stored messages is 128. After a connection failure, samhain will make the next attempt only after a deadtime that starts with 1 sec and doubles after each unsuccessful attempt (max is 2048 sec). A re-connection attempt is actually only made for the next message after the deadtime -- you should send timestamps (i.e. set the threshold to mark) to ensure re-connection attempts for failed connections.

It is possible to specify two log servers in the client configuration file. The first one will be used by default (primary), and the second one as fallback in case of a connection failure with the primary log server.

Prev | Home | Next
Log file | Up | External facilities