> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Kenneth Holter > Sent: Thursday, February 05, 2009 12:53 PM > To: rsyslog-users > Subject: Re: [rsyslog] Configuring rsyslog failover > > I understand completely. :) > > I'll sure I will find the documentation I need, even though I'm using > an > aceint version of rsyslog. :) >
Keep in mind that each version comes with a complete doc set. Even if that is missing in the package you have, you can download the same version from www.rsyslog.com and look at the included doc. Rainer > > Thanks for the help so far, anyway. > > > On 2/5/09, Rainer Gerhards <[email protected]> wrote: > > > > I am sorry, but this is going beyond what I can do for free. I'd > > consider purchasing commercial services. The reason is you try to get > > things real reliable, but you have lots of constraints and fine > subtle > > issues. There need to be made tradoffs and some tough decisions. All > in > > all, that's a real consulting project. > > > > Everything you need to know is fully documented, either in rsyslog, > it's > > code, my blog and even RFCs. I have pointed you to these things. I > fully > > understand that it is not easy to get the big picture from that. It > is > > far from being that, you need to be an expert in syslog to know > exactly > > how to put together those things. Syslog is boring to most (no > bashing), > > so we have few experts on the matter. So if you need to do things in > a > > quite reliable way, it would probably a good idea to task an expert > with > > consulting. > > > > I am sorry if that post is rather blunt, but I think it is better we > all > > know where we are. Honestly, I put up a lot of unpaid time into > making > > the project grow. I am also able to give a lot of free support. I am > > grateful Adiscon pays for this. But please understand that we not > also > > can give away consulting for free - something needs to pay the power, > > machines - and my lunch! - at the end of the day ;) > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Kenneth Holter > > > Sent: Thursday, February 05, 2009 11:32 AM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > Sorry, my fault. You said this: "Failover is available - that is > done > > > like > > > you described in your last > > > post.", and my post you referred to talked about the engineering > > stuff. > > > > > > Anyway, the second link I posted describes the failover > functionality, > > > but > > > not any specifics how the local buffer is used. Back to my > > > configuration > > > which I posted earlier in the thread: > > > > > > > > > **.* @@server1**.example.com:200* > <http://client1.example.com:200/>* > > > $ActionExecOnlyWhenPreviousIsSuspended on > > > & /var/log/localbuffer > > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > > > > It is my understanding that messages that doesn't reach the server1 > > > machine > > > will be store in the /var/log/localbuffer file. Can you point me to > > > documentation that explains that happens next with these messages? > > > > > > > > > > > > > > > On 2/5/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > As I said: the second link you posted is failover and it is a > > > supported > > > > in v2. So failover *is* available in v2. Queuing is not. > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > Sent: Thursday, February 05, 2009 9:58 AM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > Are you referring to the "smart (over-)engineering" way of > doing > > > this? > > > > > In > > > > > other words, there are no built in support for > > > failover/spooling/etc > > > > in > > > > > rsyslog version 2? > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> wrote: > > > > > > > > > > > > Failover is available - that is done like you described in > your > > > last > > > > > > post. But you need to keep an eye on the subtleties, outlined > in > > > the > > > > > > response I've written just 2 minutes ago ;). > > > > > > > > > > > > Rainer > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > [email protected]] On Behalf Of Kenneth Holter > > > > > > > Sent: Wednesday, February 04, 2009 2:03 PM > > > > > > > To: rsyslog-users > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > It seems like RHN is way behind on adding rsyslog updates > to > > > the > > > > > repo, > > > > > > > so it > > > > > > > seems like I'm more or less stuck with version 2 for now. > Are > > > > there > > > > > > any > > > > > > > failover/spooling/etc functionality in version 2? I'd like > to > > > > > increase > > > > > > > the > > > > > > > chance of syslog messages reaching the syslog server, even > if > > > it > > > > > gets > > > > > > > offline for a short while. I'm sure it's possible to > acheive > > > this > > > > > by > > > > > > > smart > > > > > > > (over-)engineering while waiting for rsyslog v3 being > released > > > on > > > > > RHN, > > > > > > > but > > > > > > > I'm all for simplicity. :) > > > > > > > > > > > > > > On 2/4/09, Kenneth Holter <[email protected]> wrote: > > > > > > > > > > > > > > > > No prob. :) > > > > > > > > > > > > > > > > Then I'm even more puzzled...I've configured my rsyslog > > > client > > > > > with > > > > > > > this > > > > > > > > setup: > > > > > > > > ** > > > > > > > > > > > > > > > > **.* @@client1.example.com:200 > > > > > > > > $ActionExecOnlyWhenPreviousIsSuspended on > > > > > > > > & /var/log/localbuffer > > > > > > > > $ActionExecOnlyWhenPreviousIsSuspended off* > > > > > > > > > > > > > > > > > > > > > > > > If I cut the link to the syslog-server (using iptables to > > > > emulate > > > > > > the > > > > > > > > logserver being down), run "logger hello" on the client, > and > > > > then > > > > > > > after a > > > > > > > > while attach the link (by flushing the iptable rules), I > see > > > > that > > > > > > the > > > > > > > hello > > > > > > > > message pops up on the rsyslog server. So some kind of > > > spooling > > > > > or > > > > > > > something > > > > > > > > seems to be active. Strange. Maybe the spooling or > whatever > > > is > > > > > done > > > > > > > on TCP > > > > > > > > level or something. Maybe the rsyslog version from RHN > > > differs > > > > > from > > > > > > > the > > > > > > > > "normal" versioning? > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards <[email protected]> > wrote: > > > > > > > > > Oops... and I just noticed you use v2. Spooling is not > > > > > available > > > > > > in > > > > > > > v2. > > > > > > > > > > > > > > > > > > Sorry for not spotting it in the first place... > > > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > From: [email protected] > [mailto:rsyslog- > > > > > > > > > > [email protected]] On Behalf Of Rainer > Gerhards > > > > > > > > > > Sent: Wednesday, February 04, 2009 10:56 AM > > > > > > > > > > To: rsyslog-users > > > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > > From: [email protected] > > > [mailto:rsyslog- > > > > > > > > > > > [email protected]] On Behalf Of Kenneth > Holter > > > > > > > > > > > Sent: Wednesday, February 04, 2009 10:13 AM > > > > > > > > > > > To: rsyslog-users > > > > > > > > > > > Subject: Re: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > > > Thanks for the quick reply. > > > > > > > > > > > > > > > > > > > > > > You're right, it's not a failover solution by > > > definition. > > > > I > > > > > > see > > > > > > > now > > > > > > > > > > > that I > > > > > > > > > > > should have outlined my needs... What I'm aiming > at, > > at > > > > > least > > > > > > > for > > > > > > > > > > now, > > > > > > > > > > > is a > > > > > > > > > > > semi-failover solution: If the syslog server (i.e. > > > > loghost) > > > > > > > goes > > > > > > > > > > down, > > > > > > > > > > > the > > > > > > > > > > > clients should simply spool the messages until the > > > server > > > > > gets > > > > > > > back > > > > > > > > > > > online. > > > > > > > > > > > > > > > > > > > > > > Back to the examples I linked to: They both seem to > > > > provide > > > > > > the > > > > > > > > > > > functionality I'm looking for. Is that correct? If > so: > > > > > what's > > > > > > > the > > > > > > > > > > > difference > > > > > > > > > > > between them? > > > > > > > > > > > > > > > > > > > > No! ;) As I said, #2 is a failover scenario - it does > > not > > > > > spool > > > > > > > but > > > > > > > > > > rather send the messags to another (failover) server > if > > > the > > > > > > > primary > > > > > > > > > > fails. > > > > > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 2/4/09, Rainer Gerhards > <[email protected]> > > > > > wrote: > > > > > > > > > > > > > > > > > > > > > > > > Hi Kenneth, > > > > > > > > > > > > > > > > > > > > > > > > the first link does NOT describe a failover case. > In > > > the > > > > > > > first > > > > > > > > > > link, > > > > > > > > > > > > data is queued while the syslogd is not > available. A > > > > > > failover > > > > > > > case > > > > > > > > > > > > (described in link two) is that if one syslogd > goes > > > > down, > > > > > > > data is > > > > > > > > > > > sent > > > > > > > > > > > > to another. This is not done in case 1: there, > > > messages > > > > > are > > > > > > > queued > > > > > > > > > > > while > > > > > > > > > > > > the syslogd is down and sent to *the same > syslogd* > > > when > > > > > it > > > > > > is > > > > > > > up > > > > > > > > > > > again. > > > > > > > > > > > > So no second syslogd involved in case 1, so this > is > > > no > > > > > > > failover > > > > > > > > > > > > scenario. > > > > > > > > > > > > > > > > > > > > > > > > HTH > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > > > > From: [email protected] > > > > > [mailto:rsyslog- > > > > > > > > > > > > > [email protected]] On Behalf Of Kenneth > > > Holter > > > > > > > > > > > > > Sent: Wednesday, February 04, 2009 9:59 AM > > > > > > > > > > > > > To: [email protected] > > > > > > > > > > > > > Subject: [rsyslog] Configuring rsyslog failover > > > > > > > > > > > > > > > > > > > > > > > > > > Hello list. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > We're running rsyslog 2.0.6 downloaded from > RHN, > > > and > > > > > are > > > > > > > about > > > > > > > > > to > > > > > > > > > > > set > > > > > > > > > > > > > up > > > > > > > > > > > > > reliability/failover. I've found two setup > > > tutorials > > > > > for > > > > > > > this: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > 1. > > > > > > > > > > > http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html > > > > > > > > > > > > > 2. > > > > > > > http://wiki.rsyslog.com/index.php/FailoverSyslogServer > > > > > > > > > > > > > > > > > > > > > > > > > > It seems like both setups configure reliable > > > transfer, > > > > > but > > > > > > > using > > > > > > > > > > a > > > > > > > > > > > > > completely different syntax. Is it so that the > > > former > > > > > one > > > > > > > is the > > > > > > > > > > > > syntax > > > > > > > > > > > > > for > > > > > > > > > > > > > newer versions of rsyslog? > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > Kenneth Holter > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > _______________________________________________ > > > > > > > > > > rsyslog mailing list > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > > > > > > rsyslog mailing list > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
