On Fri, Nov 4, 2011 at 5:41 AM, <[email protected]> wrote: [snip] > On Thu, 3 Nov 2011, Bob Corsaro wrote: >> :( The disadvantage of going directly from varnish to the remote >> syslog server is that I lose the ability to store logs if the remote >> syslog daemon is unavailable. Why do you think you get duplicates? > > Two options there. > > 1. go to a local syslog daemon and let it forward > > 2. make your remote syslog daemon highly available. > > writing to a file and then picking it up later is one of the most > complicated approaches that you can take to move logs.
Of course! Thanks for making me see the obvious solution. For future reference, my solution was to run /usr/bin/varnishnsca | /usr/bin/logger -p local0.info -t mirage-varnish Then create a rule in rsyslog to send that to the remote system: local0.* @@remote-system:514 #(use @ for udp and @@ for tcp) I'm not sure yet if rsyslog is dealing with the remote system not accepting logs by storing logs in the $WorkDirectory, but I'm sure it's doable. I'm ok with losing a few logs here and there for the time being. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
