Offline Log Spooling

Where logs are stored

• Logs are spooled to /var/cmdreporter/remoteEndpointLogger
• Spooled log files are not limited by the LogFileMax* preferences for retention times
• Spooled log files do not respect the LogFilePermission or LogFileOwnership preferences
• Any log files defined by LogFileLocation operate completely separately from the spooled logs.
  • Any spooled logs are also always written to this LogFileLocation (default: /var/log/cmdReporter.log).

When they are spooled

• Logs are spooled as soon as an event is unable to send to the collection server
• Spooled logs are retained indefinitely until connection has been restored

How spooled logs are unspooled

• cmdReporter will periodically attempt to resend logs to an offline collection server until connection has been re-established.
• Once a connection has been re-established logs will be sent in batches depending on the collection server connection method