I'm working with a set of Windows 2000 systems that may occasionally loose network connectivity. Currently i have MWAgent configured to redirect all eventlogs and text logs to a syslog host (using legacy TCP as my syslog server does not support RFC3195 yet) what happens to MWAgent if the network becomes unavailalbe?
I'm assuming that there is no queueing of messages implemented in MWAgent, is this correct?
So here's my hack around the problem. Will this work?
Have a monitoring script that checks the status of the network link, and if it discovers a certain amount of downtime, shuts down the MWAgent service until network connectivity is re-established. When the network is re-established, and MWAgent restarts, will it send all the events that occured during it's down time (e.g. catch up?) How will this be handled in the eventlog as well as in text files? Is there a way to "force" this behavior?
Thanks in advance.

