Hello Robert,
Yes, you can send logs to multiple locations. You just have to add multiple
action lines. For example:
*.* action(...first location here...)
*.* action(...second location here...)
You can also tell rsyslog to stop processing some messages after they're
processed by an action. For example:
----------------
if $msg contains 'foo' then {
action1
stop
}
*.* action2
----------------
This will make rsyslog apply action1 to messages containing 'foo' and then
stop prevent them from being processed by action2. Which means action2 will
only apply to non-'foo' messages. If you remove the 'stop', action2 will
apply to all messages, and 'foo' messages will be processed by both actions.
I hope this helps.
Best regards,
Radu
2013/9/12 Robert Ortiz <[email protected]>
>
> Thanks everyone for all the help, I don't seem to be dropping any more
packets at 150k mps, but I am seeing when I am doing a raw tcpdump to the
interface, whenever I start the rsyslog service the tcpdump drops a
significant amount of packets, I modified my sysctl.conf to :
>
> net.core.rmem_default = 2097152
> net.core.wmem_default = 2097152
> net.core.rmem_max = 10485760
> net.core.wmem_max = 10485760
>
>
> the next phase of testing is sending logs to multiple locations, I have
been looking around on how to make this happen, but I cannot seem to find
any documentation, is rsyslog capable of sending logs to multiple locations?
>
> Thanks
>
>
>
> Robert.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
