I understand completely. :) I'll sure I will find the documentation I need, even though I'm using an aceint version of rsyslog. :)
Thanks for the help so far, anyway. On 2/5/09, Rainer Gerhards <[email protected]> wrote: > > I am sorry, but this is going beyond what I can do for free. I'd > consider purchasing commercial services. The reason is you try to get > things real reliable, but you have lots of constraints and fine subtle > issues. There need to be made tradoffs and some tough decisions. All in > all, that's a real consulting project. > > Everything you need to know is fully documented, either in rsyslog, it's > code, my blog and even RFCs. I have pointed you to these things. I fully > understand that it is not easy to get the big picture from that. It is > far from being that, you need to be an expert in syslog to know exactly > how to put together those things. Syslog is boring to most (no bashing), > so we have few experts on the matter. So if you need to do things in a > quite reliable way, it would probably a good idea to task an expert with > consulting. > > I am sorry if that post is rather blunt, but I think it is better we all > know where we are. Honestly, I put up a lot of unpaid time into making > the project grow. I am also able to give a lot of free support. I am > grateful Adiscon pays for this. But please understand that we not also > can give away consulting for free - something needs to pay the power, > machines - and my lunch! - at the end of the day ;) > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Kenneth Holter > > Sent: Thursday, February 05, 2009 11:32 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > Sorry, my fault. You said this: "Failover is available - that is done > > like > > you described in your last > > post.", and my post you referred to talked about the engineering > stuff. > > > > Anyway, the second link I posted describes the failover functionality, > > but > > not any specifics how the local buffer is used. Back to my > > configuration > > which I posted earlier in the thread: > > > > > > **.* @@server1**.example.com:200* <http://client1.example.com:200/>* > > $ActionExecOnlyWhenPreviousIsSuspended on > > & /var/log/localbuffer > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > It is my understanding that messages that doesn't reach the server1 > > machine > > will be store in the /var/log/localbuffer file. Can you point me to > > documentation that explains that happens next with these messages? > > > > > > > > > > On 2/5/09, Rainer Gerhards <[email protected]> wrote: > > > > > As I said: the second link you posted is failover and it is a > > supported > > > in v2. So failover *is* available in v2. Queuing is not. > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Kenneth Holter > > > > Sent: Thursday, February 05, 2009 9:58 AM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > Are you referring to the "smart (over-)engineering" way of doing > > this? > > > > In > > > > other words, there are no built in support for > > failover/spooling/etc > > > in > > > > rsyslog version 2? > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > > > Failover is available - that is done like you described in your > > last > > > > > post. But you need to keep an eye on the subtleties, outlined in > > the > > > > > response I've written just 2 minutes ago ;). > > > > > > > > > > Rainer > > > > > > > > > > > -----Original Message----- > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > Sent: Wednesday, February 04, 2009 2:03 PM > > > > > > To: rsyslog-users > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > It seems like RHN is way behind on adding rsyslog updates to > > the > > > > repo, > > > > > > so it > > > > > > seems like I'm more or less stuck with version 2 for now. Are > > > there > > > > > any > > > > > > failover/spooling/etc functionality in version 2? I'd like to > > > > increase > > > > > > the > > > > > > chance of syslog messages reaching the syslog server, even if > > it > > > > gets > > > > > > offline for a short while. I'm sure it's possible to acheive > > this > > > > by > > > > > > smart > > > > > > (over-)engineering while waiting for rsyslog v3 being released > > on > > > > RHN, > > > > > > but > > > > > > I'm all for simplicity. :) > > > > > > > > > > > > On 2/4/09, Kenneth Holter <[email protected]> wrote: > > > > > > > > > > > > > > No prob. :) > > > > > > > > > > > > > > Then I'm even more puzzled...I've configured my rsyslog > > client > > > > with > > > > > > this > > > > > > > setup: > > > > > > > ** > > > > > > > > > > > > > > **.* @@client1.example.com:200 > > > > > > > $ActionExecOnlyWhenPreviousIsSuspended on > > > > > > > & /var/log/localbuffer > > > > > > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > > > > > > > > > > > > > > > > If I cut the link to the syslog-server (using iptables to > > > emulate > > > > > the > > > > > > > logserver being down), run "logger hello" on the client, and > > > then > > > > > > after a > > > > > > > while attach the link (by flushing the iptable rules), I see > > > that > > > > > the > > > > > > hello > > > > > > > message pops up on the rsyslog server. So some kind of > > spooling > > > > or > > > > > > something > > > > > > > seems to be active. Strange. Maybe the spooling or whatever > > is > > > > done > > > > > > on TCP > > > > > > > level or something. Maybe the rsyslog version from RHN > > differs > > > > from > > > > > > the > > > > > > > "normal" versioning? > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > Oops... and I just noticed you use v2. Spooling is not > > > > available > > > > > in > > > > > > v2. > > > > > > > > > > > > > > > > Sorry for not spotting it in the first place... > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > > > [email protected]] On Behalf Of Rainer Gerhards > > > > > > > > > Sent: Wednesday, February 04, 2009 10:56 AM > > > > > > > > > To: rsyslog-users > > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > From: [email protected] > > [mailto:rsyslog- > > > > > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > > > > > Sent: Wednesday, February 04, 2009 10:13 AM > > > > > > > > > > To: rsyslog-users > > > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > Thanks for the quick reply. > > > > > > > > > > > > > > > > > > > > You're right, it's not a failover solution by > > definition. > > > I > > > > > see > > > > > > now > > > > > > > > > > that I > > > > > > > > > > should have outlined my needs... What I'm aiming at, > at > > > > least > > > > > > for > > > > > > > > > now, > > > > > > > > > > is a > > > > > > > > > > semi-failover solution: If the syslog server (i.e. > > > loghost) > > > > > > goes > > > > > > > > > down, > > > > > > > > > > the > > > > > > > > > > clients should simply spool the messages until the > > server > > > > gets > > > > > > back > > > > > > > > > > online. > > > > > > > > > > > > > > > > > > > > Back to the examples I linked to: They both seem to > > > provide > > > > > the > > > > > > > > > > functionality I'm looking for. Is that correct? If so: > > > > what's > > > > > > the > > > > > > > > > > difference > > > > > > > > > > between them? > > > > > > > > > > > > > > > > > > No! ;) As I said, #2 is a failover scenario - it does > not > > > > spool > > > > > > but > > > > > > > > > rather send the messags to another (failover) server if > > the > > > > > > primary > > > > > > > > > fails. > > > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> > > > > wrote: > > > > > > > > > > > > > > > > > > > > > > Hi Kenneth, > > > > > > > > > > > > > > > > > > > > > > the first link does NOT describe a failover case. In > > the > > > > > > first > > > > > > > > > link, > > > > > > > > > > > data is queued while the syslogd is not available. A > > > > > failover > > > > > > case > > > > > > > > > > > (described in link two) is that if one syslogd goes > > > down, > > > > > > data is > > > > > > > > > > sent > > > > > > > > > > > to another. This is not done in case 1: there, > > messages > > > > are > > > > > > queued > > > > > > > > > > while > > > > > > > > > > > the syslogd is down and sent to *the same syslogd* > > when > > > > it > > > > > is > > > > > > up > > > > > > > > > > again. > > > > > > > > > > > So no second syslogd involved in case 1, so this is > > no > > > > > > failover > > > > > > > > > > > scenario. > > > > > > > > > > > > > > > > > > > > > > HTH > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > > > From: [email protected] > > > > [mailto:rsyslog- > > > > > > > > > > > > [email protected]] On Behalf Of Kenneth > > Holter > > > > > > > > > > > > Sent: Wednesday, February 04, 2009 9:59 AM > > > > > > > > > > > > To: [email protected] > > > > > > > > > > > > Subject: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > > > > > Hello list. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > We're running rsyslog 2.0.6 downloaded from RHN, > > and > > > > are > > > > > > about > > > > > > > > to > > > > > > > > > > set > > > > > > > > > > > > up > > > > > > > > > > > > reliability/failover. I've found two setup > > tutorials > > > > for > > > > > > this: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 1. > > > > > > > > > http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > > > > > > > > > > > 2. > > > > > > http://wiki.rsyslog.com/index.php/FailoverSyslogServer > > > > > > > > > > > > > > > > > > > > > > > > It seems like both setups configure reliable > > transfer, > > > > but > > > > > > using > > > > > > > > > a > > > > > > > > > > > > completely different syntax. Is it so that the > > former > > > > one > > > > > > is the > > > > > > > > > > > syntax > > > > > > > > > > > > for > > > > > > > > > > > > newer versions of rsyslog? > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > Kenneth Holter > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > rsyslog mailing list > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > > > > > > rsyslog mailing list > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > http://www.rsyslog.com > > > > > > > > _______________________________________________ > > > > > > > > rsyslog mailing list > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
