Mailing List Archive

Queue system Rsyslog
Hi,

I'm trying to set up a Rsyslog client which will store the log locally as well as forwarding them to a Rsyslog Collector.

To give you an overview, below is what I have so far:

#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### MODULES ####
module(load="imuxsock")
module(load="imjournal" StateFile="imjournal.state")

#### RULES ####
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log

# ### Forwarding rule ###
action(type="omfwd"
queue.filename="fwdRule1"
queue.size="10000"
queue.highwatermark="9600"
queue.lowwatermark="100"
queue.maxdiskspace="100m"
queue.saveonshutdown="on"
queue.type="LinkedList"
action.resumeRetryCount="-1"
Target="192.168.1.25"
Port="514"
Protocol="tcp")

What I would like to do is:
- Store all the logs locally following the above rules - I don't need a queue here but I need them to be store locally in case I need them
- Forward all the logs to the remote Rsyslog server. If the there is connection failure between rsyslog client and server, store in memory with a threshold of 9600 messages and then store on disk until the disk storage reach 100mo. After that drop the messages (for the last action).
- When the connection is up again, forward the log to the Rsyslog Server if it didn't reach the threshold.

However, it's like the first rules (used to store locally) take the queue parameters used by the forwarding action. When the disk space is 100mo, they stop storing locally and store in memory ... I cannot make it work and be comfortable about the behaviour of Rsyslog.

Could you please advise what I am doing wrong or if I misunderstood anything?

System Used: Centos
Rsyslog version: 8.24.0

Cheers
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Queue system Rsyslog [ In reply to ]
This looks correct. So I guess what you see is a bug in that old version. I
suggest to update to rsyslog current, which is 8.40.0 right now.

Rainer

El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (<
rsyslog@lists.adiscon.com>) escribió:

> Hi,
>
> I'm trying to set up a Rsyslog client which will store the log locally as
> well as forwarding them to a Rsyslog Collector.
>
> To give you an overview, below is what I have so far:
>
> #### GLOBAL DIRECTIVES ####
> # Where to place auxiliary files
> global(workDirectory="/var/lib/rsyslog")
>
> # Use default timestamp format
> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
>
> # Include all config files in /etc/rsyslog.d/
> $IncludeConfig /etc/rsyslog.d/*.conf
>
> #### MODULES ####
> module(load="imuxsock")
> module(load="imjournal" StateFile="imjournal.state")
>
> #### RULES ####
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> authpriv.* /var/log/secure
> mail.* -/var/log/maillog
> cron.* /var/log/cron
> *.emerg :omusrmsg:*
> uucp,news.crit /var/log/spooler
> local7.* /var/log/boot.log
>
> # ### Forwarding rule ###
> action(type="omfwd"
> queue.filename="fwdRule1"
> queue.size="10000"
> queue.highwatermark="9600"
> queue.lowwatermark="100"
> queue.maxdiskspace="100m"
> queue.saveonshutdown="on"
> queue.type="LinkedList"
> action.resumeRetryCount="-1"
> Target="192.168.1.25"
> Port="514"
> Protocol="tcp")
>
> What I would like to do is:
> - Store all the logs locally following the above rules - I don't need a
> queue here but I need them to be store locally in case I need them
> - Forward all the logs to the remote Rsyslog server. If the there is
> connection failure between rsyslog client and server, store in memory with
> a threshold of 9600 messages and then store on disk until the disk storage
> reach 100mo. After that drop the messages (for the last action).
> - When the connection is up again, forward the log to the Rsyslog Server
> if it didn't reach the threshold.
>
> However, it's like the first rules (used to store locally) take the queue
> parameters used by the forwarding action. When the disk space is 100mo,
> they stop storing locally and store in memory ... I cannot make it work and
> be comfortable about the behaviour of Rsyslog.
>
> Could you please advise what I am doing wrong or if I misunderstood
> anything?
>
> System Used: Centos
> Rsyslog version: 8.24.0
>
> Cheers
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Queue system Rsyslog [ In reply to ]
Thanks for the reply.

It's still the same issue with version 8.40.0 :/

Alex

??????? Original Message ???????
On Wednesday, 9 January 2019 09:14, Rainer Gerhards <rgerhards@hq.adiscon.com> wrote:

> This looks correct. So I guess what you see is a bug in that old version. I suggest to update to rsyslog current, which is 8.40.0 right now.
>
> Rainer
>
> El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (<rsyslog@lists.adiscon.com>) escribió:
>
>> Hi,
>>
>> I'm trying to set up a Rsyslog client which will store the log locally as well as forwarding them to a Rsyslog Collector.
>>
>> To give you an overview, below is what I have so far:
>>
>> #### GLOBAL DIRECTIVES ####
>> # Where to place auxiliary files
>> global(workDirectory="/var/lib/rsyslog")
>>
>> # Use default timestamp format
>> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
>>
>> # Include all config files in /etc/rsyslog.d/
>> $IncludeConfig /etc/rsyslog.d/*.conf
>>
>> #### MODULES ####
>> module(load="imuxsock")
>> module(load="imjournal" StateFile="imjournal.state")
>>
>> #### RULES ####
>> *.info;mail.none;authpriv.none;cron.none /var/log/messages
>> authpriv.* /var/log/secure
>> mail.* -/var/log/maillog
>> cron.* /var/log/cron
>> *.emerg :omusrmsg:*
>> uucp,news.crit /var/log/spooler
>> local7.* /var/log/boot.log
>>
>> # ### Forwarding rule ###
>> action(type="omfwd"
>> queue.filename="fwdRule1"
>> queue.size="10000"
>> queue.highwatermark="9600"
>> queue.lowwatermark="100"
>> queue.maxdiskspace="100m"
>> queue.saveonshutdown="on"
>> queue.type="LinkedList"
>> action.resumeRetryCount="-1"
>> Target="192.168.1.25"
>> Port="514"
>> Protocol="tcp")
>>
>> What I would like to do is:
>> - Store all the logs locally following the above rules - I don't need a queue here but I need them to be store locally in case I need them
>> - Forward all the logs to the remote Rsyslog server. If the there is connection failure between rsyslog client and server, store in memory with a threshold of 9600 messages and then store on disk until the disk storage reach 100mo. After that drop the messages (for the last action).
>> - When the connection is up again, forward the log to the Rsyslog Server if it didn't reach the threshold.
>>
>> However, it's like the first rules (used to store locally) take the queue parameters used by the forwarding action. When the disk space is 100mo, they stop storing locally and store in memory ... I cannot make it work and be comfortable about the behaviour of Rsyslog.
>>
>> Could you please advise what I am doing wrong or if I misunderstood anything?
>>
>> System Used: Centos
>> Rsyslog version: 8.24.0
>>
>> Cheers
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Queue system Rsyslog [ In reply to ]
El mié., 9 ene. 2019 a las 15:34, noalex (<noalex@pm.me>) escribió:

> Thanks for the reply.
>
> It's still the same issue with version 8.40.0 :/
>
>
That's really strange. Can you create a debug log? From startup until at
least one failing message?

https://www.rsyslog.com/doc/v8-stable/troubleshooting/howtodebug.html

Rainer

> Alex
>
>
>
> ??????? Original Message ???????
> On Wednesday, 9 January 2019 09:14, Rainer Gerhards <
> rgerhards@hq.adiscon.com> wrote:
>
> This looks correct. So I guess what you see is a bug in that old version.
> I suggest to update to rsyslog current, which is 8.40.0 right now.
>
> Rainer
>
> El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (<
> rsyslog@lists.adiscon.com>) escribió:
>
>> Hi,
>>
>> I'm trying to set up a Rsyslog client which will store the log locally as
>> well as forwarding them to a Rsyslog Collector.
>>
>> To give you an overview, below is what I have so far:
>>
>> #### GLOBAL DIRECTIVES ####
>> # Where to place auxiliary files
>> global(workDirectory="/var/lib/rsyslog")
>>
>> # Use default timestamp format
>> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
>>
>> # Include all config files in /etc/rsyslog.d/
>> $IncludeConfig /etc/rsyslog.d/*.conf
>>
>> #### MODULES ####
>> module(load="imuxsock")
>> module(load="imjournal" StateFile="imjournal.state")
>>
>> #### RULES ####
>> *.info;mail.none;authpriv.none;cron.none /var/log/messages
>> authpriv.* /var/log/secure
>> mail.* -/var/log/maillog
>> cron.* /var/log/cron
>> *.emerg :omusrmsg:*
>> uucp,news.crit /var/log/spooler
>> local7.* /var/log/boot.log
>>
>> # ### Forwarding rule ###
>> action(type="omfwd"
>> queue.filename="fwdRule1"
>> queue.size="10000"
>> queue.highwatermark="9600"
>> queue.lowwatermark="100"
>> queue.maxdiskspace="100m"
>> queue.saveonshutdown="on"
>> queue.type="LinkedList"
>> action.resumeRetryCount="-1"
>> Target="192.168.1.25"
>> Port="514"
>> Protocol="tcp")
>>
>> What I would like to do is:
>> - Store all the logs locally following the above rules - I don't need a
>> queue here but I need them to be store locally in case I need them
>> - Forward all the logs to the remote Rsyslog server. If the there is
>> connection failure between rsyslog client and server, store in memory with
>> a threshold of 9600 messages and then store on disk until the disk storage
>> reach 100mo. After that drop the messages (for the last action).
>> - When the connection is up again, forward the log to the Rsyslog Server
>> if it didn't reach the threshold.
>>
>> However, it's like the first rules (used to store locally) take the queue
>> parameters used by the forwarding action. When the disk space is 100mo,
>> they stop storing locally and store in memory ... I cannot make it work and
>> be comfortable about the behaviour of Rsyslog.
>>
>> Could you please advise what I am doing wrong or if I misunderstood
>> anything?
>>
>> System Used: Centos
>> Rsyslog version: 8.24.0
>>
>> Cheers
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Queue system Rsyslog [ In reply to ]
FYI: the attachment didn't make it to the list due to size, but I got it.
Will have a look, but probably tomorrow.

Rainer

El mié., 9 ene. 2019 a las 16:37, noalex (<noalex@pm.me>) escribió:

> You can find attached the debug logs (it's quite a lot so hope that what's
> you are looking for).
>
> For this test, I have:
> - Specify the configuration as such with 192.168.56.103 being not
> reachable:
> action(type="omfwd"
> queue.filename="fwdRule1"
> queue.size="500"
> queue.highwatermark="400"
> queue.lowwatermark="100"
> queue.maxdiskspace="1m"
> queue.saveonshutdown="on"
> queue.type="LinkedList"
> action.resumeRetryCount="-1"
> Target="192.168.56.103"
> Port="1514"
> Protocol="tcp")
>
> - I executed a script which will execute this entry X times "logger "PLOP
> Testmessage #$i"".
> - From around the message 2886 (Jan 9 16:21:34 rsyslog-server alex: PLOP
> Testmessage #2886), so when the maxdiskspace is about 1m, rsyslog stopped
> writing to disk even for the first actions and not just the forwarding one
> as it should do.
>
>
>
>
>
>
>
> ??????? Original Message ???????
> On Wednesday, 9 January 2019 16:08, Rainer Gerhards <
> rgerhards@hq.adiscon.com> wrote:
>
>
> El mié., 9 ene. 2019 a las 15:34, noalex (<noalex@pm.me>) escribió:
>
>> Thanks for the reply.
>>
>> It's still the same issue with version 8.40.0 :/
>>
>>
> That's really strange. Can you create a debug log? From startup until at
> least one failing message?
>
> https://www.rsyslog.com/doc/v8-stable/troubleshooting/howtodebug.html
>
> Rainer
>
>>
>> Alex
>>
>>
>>
>> ??????? Original Message ???????
>> On Wednesday, 9 January 2019 09:14, Rainer Gerhards <
>> rgerhards@hq.adiscon.com> wrote:
>>
>> This looks correct. So I guess what you see is a bug in that old version.
>> I suggest to update to rsyslog current, which is 8.40.0 right now.
>>
>> Rainer
>>
>> El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (<
>> rsyslog@lists.adiscon.com>) escribió:
>>
>>> Hi,
>>>
>>> I'm trying to set up a Rsyslog client which will store the log locally
>>> as well as forwarding them to a Rsyslog Collector.
>>>
>>> To give you an overview, below is what I have so far:
>>>
>>> #### GLOBAL DIRECTIVES ####
>>> # Where to place auxiliary files
>>> global(workDirectory="/var/lib/rsyslog")
>>>
>>> # Use default timestamp format
>>> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
>>>
>>> # Include all config files in /etc/rsyslog.d/
>>> $IncludeConfig /etc/rsyslog.d/*.conf
>>>
>>> #### MODULES ####
>>> module(load="imuxsock")
>>> module(load="imjournal" StateFile="imjournal.state")
>>>
>>> #### RULES ####
>>> *.info;mail.none;authpriv.none;cron.none /var/log/messages
>>> authpriv.* /var/log/secure
>>> mail.* -/var/log/maillog
>>> cron.* /var/log/cron
>>> *.emerg :omusrmsg:*
>>> uucp,news.crit /var/log/spooler
>>> local7.* /var/log/boot.log
>>>
>>> # ### Forwarding rule ###
>>> action(type="omfwd"
>>> queue.filename="fwdRule1"
>>> queue.size="10000"
>>> queue.highwatermark="9600"
>>> queue.lowwatermark="100"
>>> queue.maxdiskspace="100m"
>>> queue.saveonshutdown="on"
>>> queue.type="LinkedList"
>>> action.resumeRetryCount="-1"
>>> Target="192.168.1.25"
>>> Port="514"
>>> Protocol="tcp")
>>>
>>> What I would like to do is:
>>> - Store all the logs locally following the above rules - I don't need a
>>> queue here but I need them to be store locally in case I need them
>>> - Forward all the logs to the remote Rsyslog server. If the there is
>>> connection failure between rsyslog client and server, store in memory with
>>> a threshold of 9600 messages and then store on disk until the disk storage
>>> reach 100mo. After that drop the messages (for the last action).
>>> - When the connection is up again, forward the log to the Rsyslog Server
>>> if it didn't reach the threshold.
>>>
>>> However, it's like the first rules (used to store locally) take the
>>> queue parameters used by the forwarding action. When the disk space is
>>> 100mo, they stop storing locally and store in memory ... I cannot make it
>>> work and be comfortable about the behaviour of Rsyslog.
>>>
>>> Could you please advise what I am doing wrong or if I misunderstood
>>> anything?
>>>
>>> System Used: Centos
>>> Rsyslog version: 8.24.0
>>>
>>> Cheers
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>> DON'T LIKE THAT.
>>>
>>
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Queue system Rsyslog [ In reply to ]
El mié., 9 ene. 2019 a las 17:56, Rainer Gerhards (<rgerhards@hq.adiscon.com>)
escribió:

> FYI: the attachment didn't make it to the list due to size, but I got it.
> Will have a look, but probably tomorrow.
>
> Rainer
>
> El mié., 9 ene. 2019 a las 16:37, noalex (<noalex@pm.me>) escribió:
>
>> You can find attached the debug logs (it's quite a lot so hope that
>> what's you are looking for).
>>
>> For this test, I have:
>> - Specify the configuration as such with 192.168.56.103 being not
>> reachable:
>> action(type="omfwd"
>> queue.filename="fwdRule1"
>> queue.size="500"
>> queue.highwatermark="400"
>> queue.lowwatermark="100"
>> queue.maxdiskspace="1m"
>> queue.saveonshutdown="on"
>> queue.type="LinkedList"
>> action.resumeRetryCount="-1"
>> Target="192.168.56.103"
>> Port="1514"
>> Protocol="tcp")
>>
>> - I executed a script which will execute this entry X times "logger "PLOP
>> Testmessage #$i"".
>> - From around the message 2886 (Jan 9 16:21:34 rsyslog-server alex: PLOP
>> Testmessage #2886), so when the maxdiskspace is about 1m, rsyslog stopped
>> writing to disk even for the first actions and not just the forwarding one
>> as it should do.
>>
>
ah, wait - so the queue is full. That causes backpressure into the main
queue.I had a quick look, and it shows that processing continues, but very
slowly:

7298.599261569:main Q:Reg/w0 : action-7-builtin:omfwd queue: queue.c:
doEnqSingleObject: queue FULL - waiting 2000ms to drain.
7300.079519692:action-7-builtin:omfwd queue:DAwpool/w0:
action-7-builtin:omfwd queue[DA]: queue.c: doEnqSingleObject: cond timeout,
dropping message

This is working as expected. If you want to discard messages faster, you
can set a) the enqueue timeout and discardMark and discardSeverity
parameters to make the queue throw away messages when it gets full. See
here:

https://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html

HTH,
Rainer


>
>>
>>
>>
>>
>>
>>
>> ??????? Original Message ???????
>> On Wednesday, 9 January 2019 16:08, Rainer Gerhards <
>> rgerhards@hq.adiscon.com> wrote:
>>
>>
>> El mié., 9 ene. 2019 a las 15:34, noalex (<noalex@pm.me>) escribió:
>>
>>> Thanks for the reply.
>>>
>>> It's still the same issue with version 8.40.0 :/
>>>
>>>
>> That's really strange. Can you create a debug log? From startup until at
>> least one failing message?
>>
>> https://www.rsyslog.com/doc/v8-stable/troubleshooting/howtodebug.html
>>
>> Rainer
>>
>>>
>>> Alex
>>>
>>>
>>>
>>> ??????? Original Message ???????
>>> On Wednesday, 9 January 2019 09:14, Rainer Gerhards <
>>> rgerhards@hq.adiscon.com> wrote:
>>>
>>> This looks correct. So I guess what you see is a bug in that old
>>> version. I suggest to update to rsyslog current, which is 8.40.0 right now.
>>>
>>> Rainer
>>>
>>> El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (<
>>> rsyslog@lists.adiscon.com>) escribió:
>>>
>>>> Hi,
>>>>
>>>> I'm trying to set up a Rsyslog client which will store the log locally
>>>> as well as forwarding them to a Rsyslog Collector.
>>>>
>>>> To give you an overview, below is what I have so far:
>>>>
>>>> #### GLOBAL DIRECTIVES ####
>>>> # Where to place auxiliary files
>>>> global(workDirectory="/var/lib/rsyslog")
>>>>
>>>> # Use default timestamp format
>>>> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
>>>>
>>>> # Include all config files in /etc/rsyslog.d/
>>>> $IncludeConfig /etc/rsyslog.d/*.conf
>>>>
>>>> #### MODULES ####
>>>> module(load="imuxsock")
>>>> module(load="imjournal" StateFile="imjournal.state")
>>>>
>>>> #### RULES ####
>>>> *.info;mail.none;authpriv.none;cron.none /var/log/messages
>>>> authpriv.* /var/log/secure
>>>> mail.*
>>>> -/var/log/maillog
>>>> cron.* /var/log/cron
>>>> *.emerg :omusrmsg:*
>>>> uucp,news.crit /var/log/spooler
>>>> local7.*
>>>> /var/log/boot.log
>>>>
>>>> # ### Forwarding rule ###
>>>> action(type="omfwd"
>>>> queue.filename="fwdRule1"
>>>> queue.size="10000"
>>>> queue.highwatermark="9600"
>>>> queue.lowwatermark="100"
>>>> queue.maxdiskspace="100m"
>>>> queue.saveonshutdown="on"
>>>> queue.type="LinkedList"
>>>> action.resumeRetryCount="-1"
>>>> Target="192.168.1.25"
>>>> Port="514"
>>>> Protocol="tcp")
>>>>
>>>> What I would like to do is:
>>>> - Store all the logs locally following the above rules - I don't need a
>>>> queue here but I need them to be store locally in case I need them
>>>> - Forward all the logs to the remote Rsyslog server. If the there is
>>>> connection failure between rsyslog client and server, store in memory with
>>>> a threshold of 9600 messages and then store on disk until the disk storage
>>>> reach 100mo. After that drop the messages (for the last action).
>>>> - When the connection is up again, forward the log to the Rsyslog
>>>> Server if it didn't reach the threshold.
>>>>
>>>> However, it's like the first rules (used to store locally) take the
>>>> queue parameters used by the forwarding action. When the disk space is
>>>> 100mo, they stop storing locally and store in memory ... I cannot make it
>>>> work and be comfortable about the behaviour of Rsyslog.
>>>>
>>>> Could you please advise what I am doing wrong or if I misunderstood
>>>> anything?
>>>>
>>>> System Used: Centos
>>>> Rsyslog version: 8.24.0
>>>>
>>>> Cheers
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>>> you DON'T LIKE THAT.
>>>>
>>>
>>>
>>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.