Hello,
On 01/17/2014 04:35 PM, David Lang wrote:
RELP will prevent logs from being lost in transit, but if the log
arrived on the server, but was in the queue when rsyslog was killed, and
rsyslog didn't have time to write it out, you can still loose things.
how did you kill the rsyslog receiver?
Hmmm I see.
I killed it with "kill", probably not the best way to do it, but if/when
an error happen, it wouldn't be "a nice way" either...
what does your config look like? (how much stuff are you doing with the
logs?)
My config files are exactly as I list below, nothing more.
I do not plan to add anything (unless there are good suggestions for
this issue).
It will be a separate 'rsyslogd' process, dedicated for
application-level logging.
do you have any idea what your queue stats looked like? (impstats)
No idea, I did not check those.
If you are having the logs written to a database or something like that,
it's not uncommon for it to take long enough to get the logs out that
rsyslog isn't able to do so at shutdown.
My server side logging is to a local file.
Thanks for your help!
Are there any settings that can mitigate such issues?
Regards,
-gordon
Server side:
--
$ cat server.conf
module(load="imrelp" ruleset="relp")
input(type="imrelp" port="20517" tls="on")
ruleset (name="relp") { action(type="omfile" file="/tmp/server.log") }
--
Client side:
--
$ cat client.conf
module(load="imuxsock" SysSock.Use="off")
module(load="omrelp")
input(type="imuxsock" Socket="/tmp/client.sock" CreatePath="on")
action(type="omrelp" target="1.2.3.4" port="20517" tls="on")
--
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
