Hi Rainer, We're using rsyslog(3.20.0) as our central logging server and clients.
We experienced an DISK ERROR on server last month. At that time, we were using TCP to transport logs from client to server. And we also setup the configuration just like [1]. But unfortunately our central logging server got DISK error for one hour. So we lost logfiles of that period of time. I've a look at doc [1] carefully, I guess "RELIABLE" only means when server got offline or rsyslogd on it isn't running, then clients will save logs in buffer or write to a file on disk. If server is still online and rsyslogd is running, but with IO/Error or Disk Full, then client will still transfer logs to server even with RELP, coz I guess RELP only protects logs could be transferred via network successfully, it doesn't care the logs are written successfully to file on server. Am I right? So I guess if we need to prevent this, we need do some work on server? Do we have some "directives" options that we could transfer logs to a failover server if local disk fails or buffer in memory before disk got corrected? [1]: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html Thanks, -- Patrick Shen Operations Engineer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
