I would recommend that if you are copying to another server for second record keeping, use relp or at least tcp to ensure that those omfwd logs make it to the backup server.
This is the same practice we use (plus sending a smaller subset to splunk for analysis) but going to relp for the backup gave us a bit more comfort. On Fri, Oct 11, 2013 at 9:38 AM, robert s <[email protected]> wrote: > Great, thanks > > Robert > > > On Fri, Oct 11, 2013 at 11:32 AM, Rainer Gerhards > <[email protected]> wrote: >> The snippet looks good. >> >> >> On Fri, Oct 11, 2013 at 5:28 PM, robert s <[email protected]> wrote: >> >>> Hello Everyone, >>> >>> I would like to be able to send a message to a secondary location for >>> file preservation. So I figured I send the message to a mounted share >>> (NFS) and then "forward it to the second destination. >>> >>> If I wanted to forward the message would the config below be correct? >>> >>> :hostname, contains, "foo" { >>> action (type="omfile" >>> DirCreateMode="0700" >>> FileCreateMode="0644" >>> File="/var/log/foo" >>> FlushOnTXEnd="on" >>> IOBufferSize="8k" >>> ) >>> action (type="omfwd" >>> Target="192.168.166.50" >>> Port="514" >>> Protocol="udp") >>> stop >>> } >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
