Is the queue limit applied to all services or per service?
The queue limit is for all services combined. Be it a syslog listener, eventlog or file monitor. It does not differ between services, the memory queue is for all. The queue is basically to buffer message bursts that are higher than what MonitorWare Agent can forward/store. The default is 200000 log messages which can be stored in the memory.
What is better for TCP syslog forwarding – Diskqueue or Queue Diskcache?
The Queue Manager Diskcache is useful depending on whether you need high security. Beware, when enabling this, the queued messages will always be written to disk before processing. This will slow down the system a lot, depending on the speed of the harddrive. When forwarding via TCP syslog, using the diskqueue will store the messages to disk to prevent message loss in case the peer or the connection fails. This queue will only be used as needed contrary to the Queue Manager Diskcache which will be used always.
What is the recommended Queue limit?
The Queue Limit determines the amount of unprocessed messages that can be stored in the memory to allow message bursts to occur without the system stalling. Though, this needs to be tested with a real use-case and is mainly depending on the messages that are received per second and the messages that can be forwarded/written per second.