HAve you checked for any error messages from rsyslogd inside your logs (do you even log them -- many distros don't do by default :-(( )
I am asking because the snippet looks syntactically wrong (then on a separate line). Rainer > -----Original Message----- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of Eric Schoeller > Sent: Thursday, February 10, 2011 4:51 PM > To: rsyslog@lists.adiscon.com > Subject: [rsyslog] Queuing subsystem and message filtering > > Hello list, > > I recently tried out message queuing using rsyslog-5.6.3. > > Take the following config snippet: > > ... > # Throw out all messages with debug severity before we log to the > network > if $syslogseverity-text == 'debug' > then ~ > > $WorkDirectory /var/spool/rsyslog # location for work (spool) > files > $ActionQueueType LinkedList # use asynchronous processing > $ActionQueueFileName logserver-queue # set file name, also enables > disk mode > $ActionResumeRetryCount -1 # infinite retries on insert > failure > $ActionQueueSaveOnShutdown on # save in-memory data if > rsyslog > shuts down > > # Log anything that hasn't been specifically filtered out with '~' to > logserver > *.* @logserver.colorado.edu > ... > > In this scenario I would assume that all messages with the severity of > debug don't get logged over the network to 'logserver.colorado.edu'. > But > they do. If I comment all 5 of the directives that activate queuing, > the > debug messages are no longer logged over the network. > > Is this by design, and if so could someone explain why? Is this a bug? > Do I have a configuration problem? > > Thanks! > > Eric Schoeller > University of Colorado, Boulder > Information Technology Services > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
