Have central loghost configured with disk assisted queue like so: $WorkDirectory /var/log/rsyslog $ActionQueueType LinkedList $ActionQueueFileName failqueue-loghost2 $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on
# remote logging of everything *.* @@loghost1:5140 Central loghost still running syslog-ng. Had a problem with it that caused it to fail on multiple occasions over the past couple days. Resolved the problem and logs are now flowing to it, but the files that were created on the clients during this period are not going away, nor are the back logs flowing to the central loghost. For example: # syslog client #/var/log/syslog -rw------- 1 root root 1049189 Mar 16 01:13 failqueue-loghost2.00000002 -rw------- 1 root root 1048848 Mar 14 13:25 failqueue-loghost2.00000003 -rw------- 1 root root 1048648 Mar 14 17:20 failqueue-loghost2.00000004 -rw------- 1 root root 1049066 Mar 15 00:19 failqueue-loghost2.00000005 -rw------- 1 root root 1048619 Mar 15 00:27 failqueue-loghost2.00000006 -rw------- 1 root root 1048907 Mar 15 13:20 failqueue-loghost2.00000007 -rw------- 1 root root 949887 Mar 16 01:13 failqueue-loghost2.00000008 -rw------- 1 root root 1653 Mar 16 01:13 failqueue-loghost2.qi Running rsyslog-5.6.4. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
