[rsyslog] Correct configuration for multiple queues using the same action

[carlopmart]

Hi all,

 I am using rsyslog version 4.6.2 on a CentOS6 server. I am trying to 
configure rsyslog to forward all logs to two syslog receivers at the 
same time. I don't need load balancing and HA, only to send same eventas 
at the same time to both syslog receivers.

 My rsyslog.conf:

# Default spool directory
$WorkDirectory /data/rsyslog
$MainMsgQueueFileName mainq
$MainMsgQueueType LinkedList
$MainMsgQueueSaveOnShutDown on
$MainMsgQueueMaxDiskSpace 1g

$ActionQueueFileName srvfwd_first
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
if $fromhost-ip == '192.168.55.1' and $msg contains_i 
'RT_FLOW_SESSION_CLOSE' then @@172.17.22.1:5514

$ActionQueueFileName srvfwd_second
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
if $fromhost-ip == '192.168.55.1' and $msg contains_i 
'RT_FLOW_SESSION_CLOSE' then @@172.17.22.1:10514
#& ~


$ActionQueueFileName srv2fwd_first
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType Disk
$ActionResumeRetryCount -1
if $fromhost-ip == '192.168.4.2' then @@172.17.22.1:5514

$ActionQueueFileName srv2fwd_second
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType Disk
$ActionResumeRetryCount -1
if $fromhost-ip == '192.168.4.2' then @@172.17.22.1:10514
#& ~

 .. but It doesn't seems to works well .. First events creates the 
correct queues as I have defined in my rsyslog.conf, but after some 
minutes all events goes to mainq defined queue....

 I have tried to uncomment & ~ but results are the same ..

 And the last problem appears when I stop rsyslog instance and when I 
try to do a new start, events continues on disk and rsyslog doesn't 
forwards these to the others syslog servers ...

 What am I doing wrong???

 Thanks.
--
CL Martinez
carlopmart {at} gmail {d0t} com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards