> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Kenneth Holter > Sent: Wednesday, February 04, 2009 1:42 PM > To: rsyslog-users > Subject: Re: [rsyslog] Configuring rsyslog failover > > No prob. :) > > Then I'm even more puzzled...I've configured my rsyslog client with > this > setup: > ** > > **.* @@client1.example.com:200 > $ActionExecOnlyWhenPreviousIsSuspended on > & /var/log/localbuffer > $ActionExecOnlyWhenPreviousIsSuspended off* > > > If I cut the link to the syslog-server (using iptables to emulate the > logserver being down), run "logger hello" on the client, and then after > a > while attach the link (by flushing the iptable rules), I see that the > hello > message pops up on the rsyslog server. So some kind of spooling or > something > seems to be active. Strange. Maybe the spooling or whatever is done on > TCP > level or something. Maybe the rsyslog version from RHN differs from the > "normal" versioning?
This has lot's to do with your test environment (you really don't break the link but just make it impossible to send for a period of time), the local tcp send buffer and the way TCP is designed. I suggest to have an in-depth look at http://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.ht ml To do your lab, try to send multiple messages and/or make sure you restart the receiving server while the connection is blocked. You will notice some message loss during that process, this is expected, reasons are in my blog post quoted above. Note that v3 has some improved code to reduce message loss, but in any case there potentially is loss. V2 looses more messages than v3. Rainer > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > Oops... and I just noticed you use v2. Spooling is not available in > v2. > > > > Sorry for not spotting it in the first place... > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Rainer Gerhards > > > Sent: Wednesday, February 04, 2009 10:56 AM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Kenneth Holter > > > > Sent: Wednesday, February 04, 2009 10:13 AM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > Thanks for the quick reply. > > > > > > > > You're right, it's not a failover solution by definition. I see > now > > > > that I > > > > should have outlined my needs... What I'm aiming at, at least for > > > now, > > > > is a > > > > semi-failover solution: If the syslog server (i.e. loghost) goes > > > down, > > > > the > > > > clients should simply spool the messages until the server gets > back > > > > online. > > > > > > > > Back to the examples I linked to: They both seem to provide the > > > > functionality I'm looking for. Is that correct? If so: what's the > > > > difference > > > > between them? > > > > > > No! ;) As I said, #2 is a failover scenario - it does not spool but > > > rather send the messags to another (failover) server if the primary > > > fails. > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > > > Hi Kenneth, > > > > > > > > > > the first link does NOT describe a failover case. In the first > > > link, > > > > > data is queued while the syslogd is not available. A failover > case > > > > > (described in link two) is that if one syslogd goes down, data > is > > > > sent > > > > > to another. This is not done in case 1: there, messages are > queued > > > > while > > > > > the syslogd is down and sent to *the same syslogd* when it is > up > > > > again. > > > > > So no second syslogd involved in case 1, so this is no failover > > > > > scenario. > > > > > > > > > > HTH > > > > > Rainer > > > > > > > > > > > -----Original Message----- > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > Sent: Wednesday, February 04, 2009 9:59 AM > > > > > > To: [email protected] > > > > > > Subject: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > Hello list. > > > > > > > > > > > > > > > > > > We're running rsyslog 2.0.6 downloaded from RHN, and are > about > > to > > > > set > > > > > > up > > > > > > reliability/failover. I've found two setup tutorials for > this: > > > > > > > > > > > > > > > > > > 1. > > http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > > > > > 2. http://wiki.rsyslog.com/index.php/FailoverSyslogServer > > > > > > > > > > > > It seems like both setups configure reliable transfer, but > using > > > a > > > > > > completely different syntax. Is it so that the former one is > the > > > > > syntax > > > > > > for > > > > > > newer versions of rsyslog? > > > > > > > > > > > > Regards, > > > > > > Kenneth Holter > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
