All your assumptions are correct, except. > * unless the queue size is exceeded in which case events are lost The audit framework will automatically start spooling to file if: - Queue size is exceeded - Destination is down for extended period (I think 10 minutes, but need to verify)
Bosco On 3/6/17, 9:28 AM, "Nigel Jones" <[email protected]> wrote: I'm planning to use Solr for audit (easy searching, aggregation) and trying to understand failure modes.... If solr is not ready when the plugin starts up I assume we'll try to connect (1s?) then wait for a period (30s) then retry However this is on an async thread, and meanwhile audit events are queues in memory locally ... so * If solr starts after the plugin, initial events are delayed but then will log * if solr breaks, events will temporarily pause, but then resume once solr back up * unless the queue size is exceeded in which case events are lost is my understanding correct? Thanks :-) Nigel.
