I personally run RHEL 5 servers with rsyslog. Due to the lack of a current and stable rsyslog rpm, I always build rsyslog on the server. It takes less than 5 minutes and is very stable.
Daniel Anson Rackspace Managed Hosting [email protected] -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Rainer Gerhards Sent: Wednesday, February 04, 2009 7:14 AM To: rsyslog-users Subject: Re: [rsyslog] Configuring rsyslog failover Failover is available - that is done like you described in your last post. But you need to keep an eye on the subtleties, outlined in the response I've written just 2 minutes ago ;). Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Kenneth Holter > Sent: Wednesday, February 04, 2009 2:03 PM > To: rsyslog-users > Subject: Re: [rsyslog] Configuring rsyslog failover > > It seems like RHN is way behind on adding rsyslog updates to the repo, > so it > seems like I'm more or less stuck with version 2 for now. Are there any > failover/spooling/etc functionality in version 2? I'd like to increase > the > chance of syslog messages reaching the syslog server, even if it gets > offline for a short while. I'm sure it's possible to acheive this by > smart > (over-)engineering while waiting for rsyslog v3 being released on RHN, > but > I'm all for simplicity. :) > > On 2/4/09, Kenneth Holter <[email protected]> wrote: > > > > No prob. :) > > > > Then I'm even more puzzled...I've configured my rsyslog client with > this > > setup: > > ** > > > > **.* @@client1.example.com:200 > > $ActionExecOnlyWhenPreviousIsSuspended on > > & /var/log/localbuffer > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > If I cut the link to the syslog-server (using iptables to emulate the > > logserver being down), run "logger hello" on the client, and then > after a > > while attach the link (by flushing the iptable rules), I see that the > hello > > message pops up on the rsyslog server. So some kind of spooling or > something > > seems to be active. Strange. Maybe the spooling or whatever is done > on TCP > > level or something. Maybe the rsyslog version from RHN differs from > the > > "normal" versioning? > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > Oops... and I just noticed you use v2. Spooling is not available in > v2. > > > > > > Sorry for not spotting it in the first place... > > > > > > Rainer > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Rainer Gerhards > > > > Sent: Wednesday, February 04, 2009 10:56 AM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > Sent: Wednesday, February 04, 2009 10:13 AM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > Thanks for the quick reply. > > > > > > > > > > You're right, it's not a failover solution by definition. I see > now > > > > > that I > > > > > should have outlined my needs... What I'm aiming at, at least > for > > > > now, > > > > > is a > > > > > semi-failover solution: If the syslog server (i.e. loghost) > goes > > > > down, > > > > > the > > > > > clients should simply spool the messages until the server gets > back > > > > > online. > > > > > > > > > > Back to the examples I linked to: They both seem to provide the > > > > > functionality I'm looking for. Is that correct? If so: what's > the > > > > > difference > > > > > between them? > > > > > > > > No! ;) As I said, #2 is a failover scenario - it does not spool > but > > > > rather send the messags to another (failover) server if the > primary > > > > fails. > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > > > > > Hi Kenneth, > > > > > > > > > > > > the first link does NOT describe a failover case. In the > first > > > > link, > > > > > > data is queued while the syslogd is not available. A failover > case > > > > > > (described in link two) is that if one syslogd goes down, > data is > > > > > sent > > > > > > to another. This is not done in case 1: there, messages are > queued > > > > > while > > > > > > the syslogd is down and sent to *the same syslogd* when it is > up > > > > > again. > > > > > > So no second syslogd involved in case 1, so this is no > failover > > > > > > scenario. > > > > > > > > > > > > HTH > > > > > > Rainer > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > > Sent: Wednesday, February 04, 2009 9:59 AM > > > > > > > To: [email protected] > > > > > > > Subject: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > Hello list. > > > > > > > > > > > > > > > > > > > > > We're running rsyslog 2.0.6 downloaded from RHN, and are > about > > > to > > > > > set > > > > > > > up > > > > > > > reliability/failover. I've found two setup tutorials for > this: > > > > > > > > > > > > > > > > > > > > > 1. > > > http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > > > > > > 2. > http://wiki.rsyslog.com/index.php/FailoverSyslogServer > > > > > > > > > > > > > > It seems like both setups configure reliable transfer, but > using > > > > a > > > > > > > completely different syntax. Is it so that the former one > is the > > > > > > syntax > > > > > > > for > > > > > > > newer versions of rsyslog? > > > > > > > > > > > > > > Regards, > > > > > > > Kenneth Holter > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com Confidentiality Notice: This e-mail message (including any attached or embedded documents) is intended for the exclusive and confidential use of the individual or entity to which this message is addressed, and unless otherwise expressly indicated, is confidential and privileged information of Rackspace. Any dissemination, distribution or copying of the enclosed material is prohibited. If you receive this transmission in error, please notify us immediately by e-mail at [email protected], and delete the original message. Your cooperation is appreciated. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
