On Wed, 7 Nov 2012, Rainer Gerhards wrote:
-----Original Message-----
From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-
boun...@lists.adiscon.com] On Behalf Of Timur I. Bakeyev
Sent: Wednesday, November 07, 2012 2:27 PM
Hi, Rainer!
Of course you know internals of rsyslog better, so can't argue with you
here. But as for the end user such behavior for me looks undesired.
What
I'd expect:
1. All local(imuxsock) go to the local log files.
2. All remote messages would be spooled in an $ActionQueueFileName
file.
3. Nothing would block
Yup - so why not configure it that way?
Rainer,
looking through his partial config, it looks like he does have a separate
action queue with disk assist configured for the sending to the remote host.
I'm not that familiar with the disk queues, so I may be missing what he's done
wrong here, but shouldn't this queue the logs to disk and not block unless the
disk is full?
David Lang
And configuration:
$MaxMessageSize 8k
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
# Store PID of the process in the log
$SystemLogUsePIDFromSystem on
# Rate limit for imuxsock
$SystemLogRateLimitInterval 1
$SystemLogRateLimitBurst 500
$WorkDirectory /var/spool/rsyslog
$ModLoad imfile
$InputFilePollInterval 5
$InputFileName /var/log/nginx/access.log
$InputFilePersistStateInterval 100
$InputFileTag nginx/access:
$InputFileStateFile nginx_access_log_state
$InputFileFacility local7
$InputFileSeverity notice
$InputRunFileMonitor
$ActionQueueType LinkedList # enable a
separate queue for this action
$ActionQueueFileName remote # set file name,
also enables disk mode
$ActionResumeRetryCount -1 # infinite
retries on insert failure
$ActionQueueSaveOnShutdown on
*.* @@10.0.0.200
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
