Could you create a debug log with such a message? It should tell us what is going on. Instructions:
http://www.rsyslog.com/doc/troubleshoot.html Rainer > -----Original Message----- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of Eric Schoeller > Sent: Thursday, February 10, 2011 7:11 PM > To: rsyslog-users > Subject: Re: [rsyslog] Queuing subsystem and message filtering > > Oh, sorry my mail client must have munged those lines. I am getting a > clean start-up and shutdown: > > Feb 10 11:02:07 host rsyslogd: [origin software="rsyslogd" > swVersion="5.6.3" x-pid="15452" x-info="http://www.rsyslog.com";] > exiting > on signal 15. > Feb 10 11:02:07 host kernel: Kernel logging (proc) stopped. > Feb 10 11:02:07 host rsyslogd: [origin software="rsyslogd" > swVersion="5.6.3" x-pid="15884" x-info="http://www.rsyslog.com";] start > Feb 10 11:02:07 host kernel: imklog 5.6.3, log source = /proc/kmsg > started. > > Here is a better representation of it: > > http://pastebin.com/M6Lwseqr > > the two '/var/log/everything_to_send' where being used for debugging. I > actually stacked both of those lines directly above the > @logserver.colorado.edu line, and that's when I noticed a discrepancy > between what was getting logged to everything_to_send and > everything_to_send2. Then I bumped those lines back up above the > queuing > directives and observed that debug (and a bunch of other filtered > messages) were making it to logserver.colorado.edu. > > -- Eric > > Rainer Gerhards wrote: > > HAve you checked for any error messages from rsyslogd inside your > logs (do > > you even log them -- many distros don't do by default :-(( ) > > > > I am asking because the snippet looks syntactically wrong (then on a > separate > > line). > > > > Rainer > > > > > >> -----Original Message----- > >> From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > >> boun...@lists.adiscon.com] On Behalf Of Eric Schoeller > >> Sent: Thursday, February 10, 2011 4:51 PM > >> To: rsyslog@lists.adiscon.com > >> Subject: [rsyslog] Queuing subsystem and message filtering > >> > >> Hello list, > >> > >> I recently tried out message queuing using rsyslog-5.6.3. > >> > >> Take the following config snippet: > >> > >> ... > >> # Throw out all messages with debug severity before we log to the > >> network > >> if $syslogseverity-text == 'debug' > >> then ~ > >> > >> $WorkDirectory /var/spool/rsyslog # location for work (spool) > >> files > >> $ActionQueueType LinkedList # use asynchronous > processing > >> $ActionQueueFileName logserver-queue # set file name, also > enables > >> disk mode > >> $ActionResumeRetryCount -1 # infinite retries on insert > >> failure > >> $ActionQueueSaveOnShutdown on # save in-memory data if > >> rsyslog > >> shuts down > >> > >> # Log anything that hasn't been specifically filtered out with '~' > to > >> logserver > >> *.* @logserver.colorado.edu > >> ... > >> > >> In this scenario I would assume that all messages with the severity > of > >> debug don't get logged over the network to 'logserver.colorado.edu'. > >> But > >> they do. If I comment all 5 of the directives that activate queuing, > >> the > >> debug messages are no longer logged over the network. > >> > >> Is this by design, and if so could someone explain why? Is this a > bug? > >> Do I have a configuration problem? > >> > >> Thanks! > >> > >> Eric Schoeller > >> University of Colorado, Boulder > >> Information Technology Services > >> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > >> > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
