you need to enable SELinux or disable SELinux?
I could see a bug in their SELinux setup that would make it so you had to
disable it, but I don't understand how a bug could require that you enable it.
David Lang
On Fri, 24 May 2013, Jean Gabriel HAYS wrote:
Date: Fri, 24 May 2013 09:40:34 -0700
From: Jean Gabriel HAYS <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Avoid lose messages when Centralized Rsyslog server
is
down
Hello,
I don't know which distro you are using but here is a points you should
consider :
- if you are using an Rhel or a Centos distro (v6 branch), then I've
noticed there is a bug between SeLinux and $InputFile queue (which have bad
influence on queue flushing process). Restart your test with SeLinux
enabled : your queue should be flushed (yes I know it sounds a little bit
weird, but all worked fine with SeLinux enabled and I've experienced this
problem on different platforms).
Please let me know if this operation had resolved your issue. I've tried to
warn RedHat about that but they'd failed to reproduce the bug.
See you.
Sent from my Google Nexus 10.
Le 24 mai 2013 10:53, "Roberto Giordani" <[email protected]> a écrit :
Hello,
I need to know how to flush messages cached on disk on rsyslog client when
Centralized Rsyslog server was down for short period.
I use a tcp connection not RELP.
This is my configuration on client
$ModLoad imfile
$InputFileName /appl/logs/test1.log
$InputFileTag test1
$InputFileStateFile file1
$InputFileSeverity debug
$InputFileFacility local6
$InputRunFileMonitor
$InputFilePersistStateInterval 1000
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType Disk
$ActionResumeRetryCount -1
$ActionQueueTimeoutEnqueue 1
$**ActionSendResendLastMsgOnRecon**nect on
local6.debug @@10.10.1.10:10514
I see the /var/lib/rsyslog/fwdRule1.**00000053 that contains the msg
recieved from local6.debug, but if I stop the Centralized Rsyslog server
10.10.1.10 for 5 minutes, on restart the queue on client was not flushed to
it.
Could someone please indicate me the flow to reach the goal?
Thanks.
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
