On Fri, Dec 12, 2008 at 1:48 AM, Patrick Shen <[email protected]> wrote: > Hi Rainer, > > We're using rsyslog(3.20.0) as our central logging server and clients. > > We experienced an DISK ERROR on server last month. At that time, we were > using TCP to transport logs from client to server. And we also setup the > configuration just like [1]. But unfortunately our central logging > server got DISK error for one hour. So we lost logfiles of that period > of time. > > I've a look at doc [1] carefully, I guess "RELIABLE" only means when > server got offline or rsyslogd on it isn't running, then clients will > save logs in buffer or write to a file on disk. If server is still > online and rsyslogd is running, but with IO/Error or Disk Full, then > client will still transfer logs to server even with RELP, coz I guess > RELP only protects logs could be transferred via network successfully, > it doesn't care the logs are written successfully to file on server. Am > I right?
Yes. RELP Is a protocol for the reliable exchange of event logs over a network. What the destination daemon does once it has the logs is no concern of the client's. > So I guess if we need to prevent this, we need do some work on server? > Do we have some "directives" options that we could transfer logs to a > failover server if local disk fails or buffer in memory before disk got > corrected? Yes: http://wiki.rsyslog.com/index.php/FailoverSyslogServer -HKS > [1]: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > Thanks, > > -- > Patrick Shen > Operations Engineer > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
