Sorry, I was so focused on the bug (which existed anyway) that I did not notice the config problem. You need to use this directive in a rule chain. So this should work:
*.* @@<machine>:110 $ActionExecOnlyWhenPreviousIsSuspended on & @@<machine>:143 $ActionExecOnlyWhenPreviousIsSuspended off Note that the second filter has been replaced by an "&" which means that the actions are chained (and using the same filter). Please let me know if that solves the issue (note that on older v5 builds this does NOT work due to the bug). Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rory Toma > Sent: Wednesday, June 01, 2011 1:14 AM > To: rsyslog-users > Subject: Re: [rsyslog] Question on host failover > > I have updated to 5.8.1 and it still does not work. > > On 5/18/11 10:31 PM, Rainer Gerhards wrote: > > This is a bug in older versions prior to 5.8.0. > > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Rory Toma > >> Sent: Thursday, May 19, 2011 1:44 AM > >> To: rsyslog-users > >> Subject: [rsyslog] Question on host failover > >> > >> I have the following for my clients' rsyslog.conf files: > >> > >> $DefaultNetStreamDriverCAFile /etc/ca.pem > >> > >> $DefaultNetStreamDriver gtls > >> $ActionSendStreamDriverMode 1 > >> $ActionSendStreamDriverAuthMode anon > >> > >> $ActionResumeInterval 29 > >> > >> $WorkDirectory /var/log > >> > >> $ModLoad imuxsock > >> $SystemLogSocketName /var/log/log > >> $OptimizeForUniprocessor on > >> > >> *.* @@<machine>:110 > >> $ActionExecOnlyWhenPreviousIsSuspended on > >> *.* @@<machine>:143 > >> $ActionExecOnlyWhenPreviousIsSuspended off > >> > >> > >> > >> If I block port 110 from the client, I would expect that it would > >> failover to port 143. I am not seeing this. Do I have to do something > >> different here? It doesn't work if I remove the ActionExec directive, > >> either. In either case, it seems to keep sending to port 110, no > >> matter what. In this case,<machine> is the same physical machine, > >> with the same IP address, it's just a different syslog receiver process. > >> > >> This is rsyslog-5.6.2 > >> > >> thx > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
