Three buffers are used to process events: a primary memory buffer, a secondary memory buffer, and a file buffer. Depending on the amount of data being buffered, the buffering process can be in one of three states corresponding to the buffers it is using. Initially it uses a single memory buffer. When that fills, it switches to using dual memory buffers. When these buffers become full, it switches to using dual memory buffers and a file.
The current state of buffering as well as the status of each buffer can be examined with the bufutil program.