What does a forwarding server do when the destination server goes down?

[ukdad]

Hello group, I have configured a mail server running syslog-ng to forward local messages to a central syslog-ng server over TCP.

Then I started to worry.  What would happen if the remote (central) syslog server went down?

Would the mail server syslog cache the messages in any way and then resend when the central syslog server came back online?  Is there any kind of buffering / caching functionality available to configure?  

Or is the solution to configure the mail server syslog server to send to multiple destinations, i.e. a redundant core syslog infrastructure?

Your thoughts on the best pratice here would be appreciated.

Best Regards,

@UKDad

[mutex]

There is no provisions for a cache in syslog-ng (well, a pretty small one exists, but I believe syslog-ng abandons the cache after a very short time of not being able to send logs.)

The best bet is either
1) send the logs to multiple hosts
2) log locally on the mail server in addition to forwarding to the central server.  If the central server goes down, you have the local logs to use.

I would recommend performing #2 no matter what you do, since it's a pretty basic and cheap bit of redundancy for the logging.