On Thu, Jul 3, 2014 at 4:05 PM, Max Williams <[email protected]> wrote:
> Hi David, > Thanks for the idea, I've done that: > > *.* @@<remote1>:514 > $ActionExecOnlyWhenPreviousIsSuspended on > *.* @@<remote2>:514 > $ActionExecOnlyWhenPreviousIsSuspended off > > Sorry, I overlooked that posting. It was one of the extremely few cases where David was not 100% right. The original config should work well (acutally, I think it is even what is suggested in the legacy doc). I don't remember if the construct above is inteded to have the same result, even though I lean towards the edge that it should. I still suggest the test by pulling the network plug. Rainer > And now failover or failback doesn't work at all. Even when I just stop > rsyslog on one of the destinations. The rest of my rsyslog.conf is just > default RHEL. > > Am I missing something here? > > Kind regards, > Max > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of David Lang > Sent: 03 July 2014 06:59 > To: rsyslog-users > Subject: Re: [rsyslog] Failover destination doesn't work if TCP connection > not closed properly? > > > even with drop a failover should work > > however, I think you have a slight misunderstanding of what & does. > > & doesn't mean "do the same test as the prior one", it says "if the prior > test matched, do this as well" > > so try the config listing *.* instead of & > > David Lang > > On Wed, 2 Jul 2014, Chris 'Chipper' Chiapusio wrote: > > > > > are you using '-j REJECT --reject-with icmp-port-unreachable' > > > > or just the default '-j DROP'? > > > > > > DROP tells iptables to drop the packet on the floor like it never > > existed, giving the sending host no indication as to what happened. > > REJECT will respond with something and you can specify what that > something is. > > > > Chip > > > > On Tue, Jul 01, 2014 at 11:38:21AM +0000, Max Williams wrote: > >> Hi, > >> I am trying to get reliable failover logging to 2 remote hosts using > >> this > >> config: > >> > >> *.* @@<remote1>:514 > >> $ActionExecOnlyWhenPreviousIsSuspended on & @@<remote2>:514 > >> $ActionExecOnlyWhenPreviousIsSuspended off > >> > >> This works fine if I stop syslog on the remote1 host, the rsyslog > >> client host fails over and fails back with no problems. But if I use > >> iptables to drop TCP/514 on remote1 server then on the client host > >> the TCP connection goes to CLOSE_WAIT and then to LAST_ACK & SYN_SENT > >> and finally to just SYN_SENT. It then just stays as SYN_SENT > >> indefinitely and rsyslog does not failover to the second destination: > >> tcp 0 1 <client host>:40416 <remote1>:514 > >> SYN_SENT 3393/rsyslogd > >> > >> I've read Rainer's blog > >> post<http://blog.gerhards.net/2011/03/using-failover-and-asynchornous > >> -actions.html> and I do not have "$ActionQueueType LinkedList" set. > >> > >> Is there some configuration I am missing? I'm using version 5.8.10, I > >> know it's old. > >> > >> Thanks, > >> Max > >> > >> ____________________________ > >> > >> The London Metal Exchange is a company incorporated in England and > >> Wales with registered number 02128666, VAT registered number GB 918 > >> 4582 96 and having its registered office at 56 Leadenhall Street, > London EC3A 2DX. > >> > >> LME Clear Limited is a company incorporated in England and Wales with > >> registered number 07611628, VAT registered number GB 918 4582 96 and > >> having its registered office at 56 Leadenhall Street, London EC3A 2DX. > >> > >> The London Metal Exchange is a recognised investment exchange, > >> supervised by the Financial Conduct Authority (FCA). > >> > >> This email may have been sent on behalf of The London Metal Exchange, > >> LME Clear Limited, or jointly on behalf of both. > >> > >> Please note that this message is intended for the named recipient(s) > only. > >> Its contents may be confidential or subject to professional > >> privilege. If you are not an intended recipient, you may not > >> disclose, copy or use in any way the information contained in it; > >> please delete it and notify [email protected] immediately and delete > it from your system. > >> > >> Unless expressly attributed, the views expressed in this email do not > >> necessarily represent the views of the London Metal Exchange or LME > >> Clear Limited. > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > >> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > >> you DON'T LIKE THAT. > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > > ______________________________________________________________________ > This email has been scanned by the Symantec Email Security.cloud service. > For more information please visit http://www.symanteccloud.com > ______________________________________________________________________ > > ____________________________ > > The London Metal Exchange is a company incorporated in England and Wales > with registered number 02128666, VAT registered number GB 918 4582 96 and > having its registered office at 56 Leadenhall Street, London EC3A 2DX. > > LME Clear Limited is a company incorporated in England and Wales with > registered number 07611628, VAT registered number GB 918 4582 96 and having > its registered office at 56 Leadenhall Street, London EC3A 2DX. > > The London Metal Exchange is a recognised investment exchange, supervised > by the Financial Conduct Authority (FCA). > > This email may have been sent on behalf of The London Metal Exchange, LME > Clear Limited, or jointly on behalf of both. > > Please note that this message is intended for the named recipient(s) only. > Its contents may be confidential or subject to professional privilege. If > you are not an intended recipient, you may not disclose, copy or use in any > way the information contained in it; please delete it and notify > [email protected] immediately and delete it from your system. > > Unless expressly attributed, the views expressed in this email do not > necessarily represent the views of the London Metal Exchange or LME Clear > Limited. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
