In my experience, it won't recover, but that was with 7.0, I think. I doubt that it's changed, but it was enough to prevent using TCP logging for us. Some drops were better than no logging...however, it is possible to make the firewall stop passing traffic if logging fails, I believe, so that could be used as an avenue toward recovery, if the tradeoff is acceptable.
George
