Hi.
I have a farm of X systems all forwarding logs to a central rsyslog server. My
plan is to add a second system and configure the clients to forward the logs on
the secondary one if for some reason the primary rsyslog server fails.
I went through the documentation and the example provided is straight forward.
if($msg contains "error") then {
action(type="omfwd" target="primary-syslog.example.com" port="10514"
protocol="tcp")
action(type="omfwd" target="secondary-1-syslog.example.com" port="10514"
action.execOnlyWhenPreviousIsSuspended="on")
action(type="omfile" tag="failover" file="/var/log/localbuffer"
action.execOnlyWhenPreviousIsSuspended="on")
}
I am using action queue (linked list) on my forwarding in order to buffer logs
when the remote server is down.
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwd_spool
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.* @@remoteA.server.net:514
The documentation states that when using asynchronous queue like LinkedList,
this config will not work and the solution is to add everything inside a
RuleSet and assign a queue to the ruleset.
This is when it starts getting rough for me. Within the farm, I have numerous
systems running rsyslog 5.8.10 which unfortunately (very very unfortunately)
cannot be updated at the moment.
My questions are:
1. Is there a way to implement this solution (Ruleset + backup system +
spooling) with a syntax that will work on both rsyslog5 and rsyslog8 versions?
As far as I understood, I must use omruleset module, but I am not sure how this
will behave with rsyslog8.
2.
3. Why would one use omfile as last resort since you have the option to use
LinkedList? I mean, with omfile the logs won't be forwarded but instead will be
saved on disk. With linkedList, logs will be automatically forwarded once the
remote system is available plus, spooled messages will be cleared.
Thanks
Dimi
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
