How clients handle offline syslog servers
 

Hi,
How do clients handle offline syslog servers?

Will the log files be buffered locally to be sent to the syslog server when it comes back online, or will any log data generated during downtime be lost in cyber space?

Syslog is conventionally a unidirectional UDP data flow. There is NOTHING that tells the client about the success of sending the syslog, so it is utterly oblivious to it. It is possible to use TCP syslog on some clients, e.g. using syslog-ng, and they can then be aware of the inability to connect and buffer accordingly, but this is no standard by any means. there is some discussion of it at the bottom of the syslog-ng faq here - http://www.campin.net/syslog-ng/faq.html