On 12/16/2013 12:42 AM, Rainer Gerhards wrote:
On Mon, Dec 16, 2013 at 9:35 AM, Erik Steffl <[email protected]> wrote:
if
prifilt("local0.*") or
...
(prifilt("kern.info") and ($msg == '-- MARK --'))
then {
action(type="mmjsonparse")
if $parsesuccess == "OK" then {
action(
type="omrelp"
target="elb.collector.prod.logs.ylmmuy.com"
port="5140"
template="json"
)
} else {
action(
type="omrelp"
target="elb.collector.prod.logs.ylmmuy.com"
port="5140"
template="text"
)
}
stop
}
that's what I suspected. You use the defaults, which means "disable me for
30 seconds if the connections break continuesly". Try
use
action(
type="omrelp"
target="elb.collector.prod.logs.ylmmuy.com"
port="5140"
template="text"
*action.resumeRetryCount="-1"*
*action.resumeInterval="5"*
)
to get you started. It will try infinitely to send messages, but will
pause 5 seconds between retries. Note that you may run into trouble if the
destination is offline for an extended period of time.
ok, will try this tomorrow (pacific time (San Francisco)), now too
deep into night here :) thanks!
assuming you meant this in other email where you were askign if I'm
going to try your config suggestions (or did I miss something?).
erik
http://www.rsyslog.com/doc/omrelp.html don't see the retry settings, are
these some generic action retries?
action parameters applying to all actions:
http://www.rsyslog.com/doc/rsyslog_conf_actions.html
(you know the doc discussion, so no need to explain it may be unintuitive
to find ;-))
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
