I am sorry, but this is going beyond what I can do for free. I'd consider purchasing commercial services. The reason is you try to get things real reliable, but you have lots of constraints and fine subtle issues. There need to be made tradoffs and some tough decisions. All in all, that's a real consulting project.
Everything you need to know is fully documented, either in rsyslog, it's code, my blog and even RFCs. I have pointed you to these things. I fully understand that it is not easy to get the big picture from that. It is far from being that, you need to be an expert in syslog to know exactly how to put together those things. Syslog is boring to most (no bashing), so we have few experts on the matter. So if you need to do things in a quite reliable way, it would probably a good idea to task an expert with consulting. I am sorry if that post is rather blunt, but I think it is better we all know where we are. Honestly, I put up a lot of unpaid time into making the project grow. I am also able to give a lot of free support. I am grateful Adiscon pays for this. But please understand that we not also can give away consulting for free - something needs to pay the power, machines - and my lunch! - at the end of the day ;) Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Kenneth Holter > Sent: Thursday, February 05, 2009 11:32 AM > To: rsyslog-users > Subject: Re: [rsyslog] Configuring rsyslog failover > > Sorry, my fault. You said this: "Failover is available - that is done > like > you described in your last > post.", and my post you referred to talked about the engineering stuff. > > Anyway, the second link I posted describes the failover functionality, > but > not any specifics how the local buffer is used. Back to my > configuration > which I posted earlier in the thread: > > > **.* @@server1**.example.com:200* <http://client1.example.com:200/>* > $ActionExecOnlyWhenPreviousIsSuspended on > & /var/log/localbuffer > $ActionExecOnlyWhenPreviousIsSuspended off* > > > It is my understanding that messages that doesn't reach the server1 > machine > will be store in the /var/log/localbuffer file. Can you point me to > documentation that explains that happens next with these messages? > > > > > On 2/5/09, Rainer Gerhards <[email protected]> wrote: > > > As I said: the second link you posted is failover and it is a > supported > > in v2. So failover *is* available in v2. Queuing is not. > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Kenneth Holter > > > Sent: Thursday, February 05, 2009 9:58 AM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > Are you referring to the "smart (over-)engineering" way of doing > this? > > > In > > > other words, there are no built in support for > failover/spooling/etc > > in > > > rsyslog version 2? > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > Failover is available - that is done like you described in your > last > > > > post. But you need to keep an eye on the subtleties, outlined in > the > > > > response I've written just 2 minutes ago ;). > > > > > > > > Rainer > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > Sent: Wednesday, February 04, 2009 2:03 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > It seems like RHN is way behind on adding rsyslog updates to > the > > > repo, > > > > > so it > > > > > seems like I'm more or less stuck with version 2 for now. Are > > there > > > > any > > > > > failover/spooling/etc functionality in version 2? I'd like to > > > increase > > > > > the > > > > > chance of syslog messages reaching the syslog server, even if > it > > > gets > > > > > offline for a short while. I'm sure it's possible to acheive > this > > > by > > > > > smart > > > > > (over-)engineering while waiting for rsyslog v3 being released > on > > > RHN, > > > > > but > > > > > I'm all for simplicity. :) > > > > > > > > > > On 2/4/09, Kenneth Holter <[email protected]> wrote: > > > > > > > > > > > > No prob. :) > > > > > > > > > > > > Then I'm even more puzzled...I've configured my rsyslog > client > > > with > > > > > this > > > > > > setup: > > > > > > ** > > > > > > > > > > > > **.* @@client1.example.com:200 > > > > > > $ActionExecOnlyWhenPreviousIsSuspended on > > > > > > & /var/log/localbuffer > > > > > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > > > > > > > > > > > > > If I cut the link to the syslog-server (using iptables to > > emulate > > > > the > > > > > > logserver being down), run "logger hello" on the client, and > > then > > > > > after a > > > > > > while attach the link (by flushing the iptable rules), I see > > that > > > > the > > > > > hello > > > > > > message pops up on the rsyslog server. So some kind of > spooling > > > or > > > > > something > > > > > > seems to be active. Strange. Maybe the spooling or whatever > is > > > done > > > > > on TCP > > > > > > level or something. Maybe the rsyslog version from RHN > differs > > > from > > > > > the > > > > > > "normal" versioning? > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > Oops... and I just noticed you use v2. Spooling is not > > > available > > > > in > > > > > v2. > > > > > > > > > > > > > > Sorry for not spotting it in the first place... > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > > [email protected]] On Behalf Of Rainer Gerhards > > > > > > > > Sent: Wednesday, February 04, 2009 10:56 AM > > > > > > > > To: rsyslog-users > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: [email protected] > [mailto:rsyslog- > > > > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > > > > Sent: Wednesday, February 04, 2009 10:13 AM > > > > > > > > > To: rsyslog-users > > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > Thanks for the quick reply. > > > > > > > > > > > > > > > > > > You're right, it's not a failover solution by > definition. > > I > > > > see > > > > > now > > > > > > > > > that I > > > > > > > > > should have outlined my needs... What I'm aiming at, at > > > least > > > > > for > > > > > > > > now, > > > > > > > > > is a > > > > > > > > > semi-failover solution: If the syslog server (i.e. > > loghost) > > > > > goes > > > > > > > > down, > > > > > > > > > the > > > > > > > > > clients should simply spool the messages until the > server > > > gets > > > > > back > > > > > > > > > online. > > > > > > > > > > > > > > > > > > Back to the examples I linked to: They both seem to > > provide > > > > the > > > > > > > > > functionality I'm looking for. Is that correct? If so: > > > what's > > > > > the > > > > > > > > > difference > > > > > > > > > between them? > > > > > > > > > > > > > > > > No! ;) As I said, #2 is a failover scenario - it does not > > > spool > > > > > but > > > > > > > > rather send the messags to another (failover) server if > the > > > > > primary > > > > > > > > fails. > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> > > > wrote: > > > > > > > > > > > > > > > > > > > > Hi Kenneth, > > > > > > > > > > > > > > > > > > > > the first link does NOT describe a failover case. In > the > > > > > first > > > > > > > > link, > > > > > > > > > > data is queued while the syslogd is not available. A > > > > failover > > > > > case > > > > > > > > > > (described in link two) is that if one syslogd goes > > down, > > > > > data is > > > > > > > > > sent > > > > > > > > > > to another. This is not done in case 1: there, > messages > > > are > > > > > queued > > > > > > > > > while > > > > > > > > > > the syslogd is down and sent to *the same syslogd* > when > > > it > > > > is > > > > > up > > > > > > > > > again. > > > > > > > > > > So no second syslogd involved in case 1, so this is > no > > > > > failover > > > > > > > > > > scenario. > > > > > > > > > > > > > > > > > > > > HTH > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > > From: [email protected] > > > [mailto:rsyslog- > > > > > > > > > > > [email protected]] On Behalf Of Kenneth > Holter > > > > > > > > > > > Sent: Wednesday, February 04, 2009 9:59 AM > > > > > > > > > > > To: [email protected] > > > > > > > > > > > Subject: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > > > Hello list. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > We're running rsyslog 2.0.6 downloaded from RHN, > and > > > are > > > > > about > > > > > > > to > > > > > > > > > set > > > > > > > > > > > up > > > > > > > > > > > reliability/failover. I've found two setup > tutorials > > > for > > > > > this: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 1. > > > > > > > http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > > > > > > > > > > 2. > > > > > http://wiki.rsyslog.com/index.php/FailoverSyslogServer > > > > > > > > > > > > > > > > > > > > > > It seems like both setups configure reliable > transfer, > > > but > > > > > using > > > > > > > > a > > > > > > > > > > > completely different syntax. Is it so that the > former > > > one > > > > > is the > > > > > > > > > > syntax > > > > > > > > > > > for > > > > > > > > > > > newer versions of rsyslog? > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > Kenneth Holter > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > _______________________________________________ > > > > > > > > > > rsyslog mailing list > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > rsyslog mailing list > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > http://www.rsyslog.com > > > > > > > > _______________________________________________ > > > > > > > > rsyslog mailing list > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
