Depending on your syslog forwarder's capabilities, you have two possible results:
- If the forwarder is smart enough to understand or discover that its forward destination is unavailable, and if it is configured to cache and retry failed forwarded messages, then when the Internet (and the second syslog server) become available, it will send the cached messages to them.
- If the first syslog forwarder is not smart enough to know the destination server is unavailable to receive forwarded messages, then they will be unavailable to that second server. Users will need to access historical records from the first server to see the messages.
My Kiwi solution is at least eight years old; it's smart enough to hold one to messages and keep trying to resend them until they succeed. I'm not familiar with newer versions, and whether they retain this capability.