Offline buffer

Ferro Sentry is designed to never lose security events or posture findings due to temporary network failures. When the local Nexus Agent or cloud endpoint is unreachable, the agent automatically switches to a local disk buffer and replays accumulated data once connectivity is restored.

How it works

  1. On each security finding or audit tick, the agent attempts to send event envelopes to the configured endpoint.
  2. If the send fails (connection refused, timeout, DNS failure), the batch is written to a local buffer file on disk instead of being discarded.
  3. On the next successful connection, the agent replays all buffered batches in order before resuming normal operation.
  4. If the buffer reaches the configured maximum size (FERROSENTRY_BUFFER_MAX_MB, default 100 MB), the oldest events are dropped to make room for new threat alerts.
Security findings in the buffer retain their original event timestamps, ensuring historical audit accuracy even after network outages.

Buffer location

Default locations by platform:

  • Linux: /var/lib/ferrosentry/buffer/
  • Windows: C:\ProgramData\ferro-sentry\buffer\

Override with the FERROSENTRY_BUFFER_PATH environment variable:

bash
FERROSENTRY_BUFFER_PATH=/data/ferrosentry/buffer

Monitoring buffer state

The agent logs buffer activity at info level:

Log output
INFO ferro_sentry: endpoint unreachable, buffering findings (buffer: 4 MB / 100 MB)
INFO ferro_sentry: connection restored, replaying 12 buffered event batches
INFO ferro_sentry: buffer drained, resuming live stream