What happens to the logs if the Log Insight server is down or if the Log Insight Windows agent is not able to commmunicate with Log Insight Server

[mohanguttikonda]

If the Log Insight Windows agent is not able to communicate with Log Insight Server due to either network issue or the Log Insight server is down, what will happen to the logs on the machine which agent is monitoring?

Are the logs sent again to the server from where it failed last time?

How frequently does the windows agent sends the data to Server? Is it like, as soon as the agent finds any change to the log files it is monitoring are sent or any time interval is used by the agent.

And What is the amount(size) of data that windows agent sends to Server per call?

Thanks in advance.

Regards,

Mohan G

[sflanders · Accepted solution]

1.) Agent will cache them to storage -- default to 200MB, but can be increased up to 2GB. Once the cache is full the agent will drop logs.

2.) Whatever is in the cache is sent

3.) Very close to real-time and similar to other syslog agents. Some batching is down plus the cfapi sends compressed events

4.) For cfapi depends, but less than syslog. For syslog, same as syslog so usually around 170-200 bytes. If you are looking for bandwidth calculating see: http://sflanders.net/2014/08/20/log-insight-calculator/

[mohanguttikonda]

Thanks for quick response.

[sflanders]

No problem -- can you mark your question as answered? If you do not see the option, try a different browser.