I've technically got a two part question here and I'm pretty new to Syslog in general. Our Kiwi Syslog server forwards it's logs to a SQL Server and I've got to bring the SQL Server down for a consistency repair that I can't fix offline at the moment. Here's my questions.
1. Will the Syslog buffer store messages that it's unable to transmit to the SQL or will it only store messages it can't process quick enough in it's own database? Because I can't lose any logs so if that's an issue I'll have to build a second sql to transfer the logs to.
2. The default buffer shows as 500,000 and my registry doesn't list anything so I must have the default set up. If I want to push it all the way to 10M (since this VM has tons of CPU/RAM) will I need to restart Kiwi for the change to take effect or will it query the registry after a certain interval for changes?