remember that the in-memory queues will hold 1000 messages by default, so it's
only when you have more than that queued up that you will see things spill out
to disk.
David Lang
I would suggest enabling impstats to show you data on the rsyslog internal
state (for testing, have it write stats frequently, say every 10 sec or so, to a
local file)
David Lang
On Tue, 8 Oct 2013, Pol Hallen wrote:
Date: Tue, 8 Oct 2013 13:57:22 +0200
From: Pol Hallen <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] log server
sorry :-( copy&paste problem :-/
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by
rklogd)
$ModLoad immark # provides --MARK-- message capability
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# certificate files - just CA for a client
$DefaultNetstreamDriverCAFile /etc/ssl/rsyslog/ca.pem
# set up the action
$DefaultNetstreamDriver gtls # use gtls netstream driver
$ActionSendStreamDriverMode 1 # require TLS for the connection
$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
$WorkDirectory /var/spool/rsyslog # destination queue directory
$ActionQueueType LinkedList # de-couple this action queue
$ActionQueueFileName logs # set a file for this action;
enables disk mode
$ActionResumeRetryCount -1 # infinite retries on failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.* @@(o)ip:port
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
