Hi Oded, I've never seen this issue, but maybe you can see something in the debug log?
To get the debug log, I usually start rsyslog with something like: # rsyslogd -dn > /var/log/rsyslog.log Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Mon, Aug 11, 2014 at 4:08 PM, Oded Arbel <[email protected]> wrote: > Hi list, > > I've been using the rsyslog version 5.8 delivered with Ubuntu 12.04 > (which my servers are currently running with) to forward message to a > central logstash server over TCP, and that worked fine - the > forwarding part, I had problems with multiline messages and other > formatting issues, so I upgraded to rsyslog 8 and started to use the > omfwd module with a complex template - and now those problems are > solved, but I have a new one. > > The central logging server is on EC2 with an elastic IP and I update > its configuration from time to time by basically building a new server > and moving the elastic IP. With the old 5.8 installation, this used to > work fine - as soon as the elastic IP moved, all the rsyslog daemons > would lose the connection to the server and reconnect. With version > 8's omfwd, this doesn't happen - rsyslog doesn't notice the connection > dropping and doesn't reconnect. I have to log in to each servers and > restart the service to get it to deliver messages again. > > There are messages sent to the rsyslogds during that time, and these > are logged to the local files correctly, but not delivered to the > central server (neither the old nor the new one). Also, nothing about > this is logged to the local syslog file. > > Please advise? > -- > Oded > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
