Can I lose events if the bandwidth limit on my LightWeightForwarder is set too low?

[maverick]

On my LightWeightForwader (LWF), if I set the bandwidth thruput limit in limits.conf too low and the queue fills up on the LWF, will it back off until it has sent the queue? Or could you lose data?

[gkanapathy · Accepted solution]

If the limit is so low that monitored file rolls (and the rolled filename isn't being monitored) before it can be sent, then yes, you will lose the events that remained in that file. This can happen if the amount written to the file is higher than the limit over a long enough period of time, or if the file rolls over very quickly.