Ok Rainer
In the clients:
OS= opensuse 10.0
rsyslog version: 3.19.7
In the server
OS=Debian 4.0
rsyslog version: 3.18.2
I attach the configuration files of the clients and the servers.
The remote server is 192.1.4.215.
Thanks
Rainer Gerhards wrote:
This sounds like you are overdoing "reliable delivery". But I need configs
and version information to tell you what may be the case. If it is an older
v3 version, this may also be a bug in rsyslog.
HTH
Rainer
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Mikel Jimenez
Sent: Tuesday, September 15, 2009 10:53 AM
To: [email protected]
Subject: [rsyslog] server frozen when remote logging
Hi!!
I have 80 servers logging to a centralized rsyslog, and I have
experimented the kaos!!
Accidentaly the central server shutdowns, and one hour later, all the
80
servers frezze.
Can not access ssh, ping...
I use Debian in central server, and suse in nodes.
Thanks!
--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82
# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.
$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imuxsock.so # provides support for local system logging (e.g. via
logger command)
$ModLoad imklog.so # kernel logging (formerly provided by rklogd)
#######LOGS AVASA########
if $msg contains 'GUI_set' and not $msg contains 'VALIDADOR' then @@192.1.4.215
if $msg contains 'GUI_set' and not $msg contains 'hora' then @@192.1.4.215
if $msg contains 'GUI_set' and not $msg contains 'PRG' then @@192.1.4.215
:msg, contains, "SL" @@192.1.4.215
EST=192.1.100.100
########LOGS /VAR/LOG/MESSAGES PRG PLC ANT C_E C_S#########
:msg, contains, "GUI" @@$EST
:msg, contains, "GUI" /var/log/messages
& ~
:msg, contains, "SL" @@192.1.4.215
:msg, contains, "SL" @@$EST
:msg, contains, "SL" /var/log/messages
& ~
:msg, contains, "ML" @@192.1.4.215
:msg, contains, "ML" @@$EST
:msg, contains, "ML" /var/log/messages
& ~
:msg, contains, "PRG" @@192.1.4.215
:msg, contains, "PRG" @@$EST
:msg, contains, "PRG" /var/log/messages
& ~
:msg, contains, "PLC" @@192.1.4.215
:msg, contains, "PLC" @@$EST
:msg, contains, "PLC" /var/log/messages
& ~
:msg, contains, "ANT" @@192.1.4.215
:msg, contains, "ANT" @@$EST
:msg, contains, "ANT" /var/log/messages
& ~
:msg, contains, "C_E" @@192.1.4.215
:msg, contains, "C_E" @@$EST
:msg, contains, "C_E" /var/log/messages
& ~
:msg, contains, "C_S" @@192.1.4.215
:msg, contains, "C_S" @@$EST
:msg, contains, "C_S" /var/log/messages
#######LOGS AVASA########
*.* @@192.1.4.215
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none -/var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* -/var/log/cron
# Everybody gets emergency messages
#*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit -/var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
*.* /var/log/syslog
# Remote Logging (we use TCP for reliable delivery)
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /rsyslog/spool # where to place spool files
#$ActionQueueFileName uniqName # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host
# ######### Receiving Messages from Remote Hosts ##########
# TCP Syslog Server:
# provides TCP syslog reception and GSS-API (if compiled to support it)
$ModLoad imtcp.so # load module
$InputTCPServerRun 514
# Note: as of now, you need to use the -t command line option to
# enable TCP reception (e.g. -t514 to run a server at port 514/tcp)
# This will change in later v3 releases.
# UDP Syslog Server:
#$ModLoad imudp.so # provides UDP syslog reception
#$UDPServerRun 514 # start a UDP syslog server at standard port 514
# /etc/rsyslog.conf Configuration file for rsyslog v3.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
$ModLoad ommysql
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
# Descomentamos estas dos lineas para que rsyslog
# pueda recibir logs desde el exterior
# AVASA 2008
$ModLoad imtcp
$InputTCPServerRun 514
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use default timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
#
# Include all config files in /etc/rsyslog.d/
#
#$IncludeConfig /etc/rsyslog.d/*.conf
*.* :ommysql:localhost,Syslog,userlog,userlog
###############
#### RULES ####
###############
###############FILTROS MYSQL###############
:hostname, regex, "e00$" :ommysql:localhost,e00,userlog,userlog
& ~
:hostname, regex, "e01$" :ommysql:localhost,e01,userlog,userlog
& ~
:hostname, regex, "e02$" :ommysql:localhost,e02,userlog,userlog
& ~
:hostname, regex, "e03$" :ommysql:localhost,e03,userlog,userlog
& ~
:hostname, regex, "e04$" :ommysql:localhost,e04,userlog,userlog
& ~
:hostname, regex, "e05$" :ommysql:localhost,e05,userlog,userlog
& ~
:hostname, regex, "e06$" :ommysql:localhost,e06,userlog,userlog
& ~
:hostname, regex, "e07$" :ommysql:localhost,e07,userlog,userlog
& ~
:hostname, regex, "e08$" :ommysql:localhost,e08,userlog,userlog
& ~
:hostname, regex, "e09$" :ommysql:localhost,e09,userlog,userlog
& ~
:hostname, regex, "e10$" :ommysql:localhost,e10,userlog,userlog
& ~
:hostname, regex, "e11$" :ommysql:localhost,e11,userlog,userlog
& ~
:hostname, regex, "e12$" :ommysql:localhost,e12,userlog,userlog
& ~
:hostname, regex, "e13$" :ommysql:localhost,e13,userlog,userlog
& ~
:hostname, regex, "e14$" :ommysql:localhost,e14,userlog,userlog
& ~
:hostname, regex, "e15$" :ommysql:localhost,e15,userlog,userlog
& ~
:hostname, regex, "e16$" :ommysql:localhost,e16,userlog,userlog
& ~
:hostname, regex, "e17$" :ommysql:localhost,e17,userlog,userlog
& ~
:hostname, regex, "e18$" :ommysql:localhost,e18,userlog,userlog
& ~
:hostname, regex, "e19$" :ommysql:localhost,e19,userlog,userlog
& ~
:hostname, regex, "e20$" :ommysql:localhost,e20,userlog,userlog
& ~
:hostname, regex, "e21$" :ommysql:localhost,e21,userlog,userlog
& ~
:hostname, regex, "e22$" :ommysql:localhost,e22,userlog,userlog
& ~
:hostname, regex, "e25$" :ommysql:localhost,e25,userlog,userlog
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg *
#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8
# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
# you must invoke `xconsole' with the `-file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
# busy site..
#
daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
