Howdy folks, I'm trying to get an odd use-case working for omfwd (UDP), and was wondering how I can configure rsyslog to make this happen.
When my system first comes online, it may not have a route to the syslog server, and rsyslog correctly gets errors from sendto and suspends the target. So far so good. What I'd like to do is persist all the messages until we do have the route, and then send them all. I suspect this involves a queue for the action, with some retries. Additionally, I'd like to suppress the (many) messages around the target being suspended. It appears omfwd doesn't respect action.reportSuspension="off" or action.reportSuspensionContinuation="off" Am I doing something wrong? How can I configure rsyslog to achieve these goals? Thanks, Daniel Example action: *.* action(type="omfwd" Target="x.x.x.x" Port="yyy" queue.type="LinkedList" action.resumeInterval="10" action.resumeRetryCount="10" action.reportSuspension="off" action.reportSuspensionContinuation="off") Contents of /var/log/messages: 2020-09-24T11:29:30.167414-07:00 a rsyslogd: omfwd/udp: socket 5: sendto() error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167427-07:00 a rsyslogd: omfwd/udp: socket 11: sendto() error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167433-07:00 a rsyslogd: omfwd: socket 5: error 101 sending via udp: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167441-07:00 a rsyslogd: action 'action-3-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2008.0 try https://www.rsyslog.com/e/2007 ] 2020-09-24T11:29:30.167448-07:00 a rsyslogd: omfwd: socket 11: error 101 sending via udp: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167456-07:00 a rsyslogd: action 'action-4-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2008.0 try https://www.rsyslog.com/e/2007 ] 2020-09-24T11:29:30.167464-07:00 a rsyslogd: omfwd/udp: socket 1: sendto() error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167472-07:00 a rsyslogd: omfwd/udp: socket 2: sendto() error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167476-07:00 a rsyslogd: omfwd: socket 1: error 101 sending via udp: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] 2020-09-24T11:29:30.167480-07:00 a rsyslogd: omfwd: socket 2: error 101 sending via udp: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354 ] _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
