wesley.cole, I spoke with Engineering and here are the details.
wesley.cole wrote:
1. Will the Syslog buffer store messages that it's unable to transmit to the SQL or will it only store messages it can't process quick enough in it's own database? Because I can't lose any logs so if that's an issue I'll have to build a second sql to transfer the logs to.
We can enable the database caching by adding a registry entry. The below help file link will help you to enable that feature.
http://www.kiwisyslog.com/help/syslog/index.html?databaselogger_disabledata.htm
Another option would be that you can use the Log to file action to avoid losing data. We recommending this option if the traffic is high and if the outage is likely more than few hours.
wesley.cole wrote:
2. The default buffer shows as 500,000 and my registry doesn't list anything so I must have the default set up. If I want to push it all the way to 10M (since this VM has tons of CPU/RAM) will I need to restart Kiwi for the change to take effect or will it query the registry after a certain interval for changes?
Please see the below help file link, which will help you increase the message buffer by adding a registry entry.
http://www.kiwisyslog.com/help/syslog/adv_reg_msg_buffer_size.htm
Please Note: All manual registry changes must require a Kiwi Syslog Server Service Restart to reflect the changes.