Hey all,
I wish to have the following centralized logging system :
1) all rsyslog clients should send their logs to a primary server over RELP
2) If the primary server goes down, rsyslog clients should switch to a
secondary rsyslog-RELP server
Config File :
$ModLoad omrelp
### First Part ###$WorkDirectory /var/log/spool # where to place spool
files$ActionQueueFileName fwdrelp # unique name prefix for spool
files$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as
possible)$ActionQueueSaveOnShutdown on # save messages to disk on
shutdown$ActionQueueType LinkedList # run
asynchronously$ActionResumeRetryCount -1 # infinite retries if host is down
### Second Part ###*.*
:omrelp:logserver01:6514$ActionExecOnlyWhenPreviousIsSuspended on&
:omrelp:logserver02:6514&
/var/log/localbuffer.log$ActionExecOnlyWhenPreviousIsSuspended off
However, when the primary server goes down, spool files are being generated and
syslog flux is never redirected to the secondary server ==> The rsyslog client
is waiting for the primary server to goes up again in order to resend spool
files.
Trying to delete the first part of the config file and use only the second one
solved a part of the problem ==> Failover works and rsyslog automatically
switches between its two destination. However Disk-based buffering is not
configured anymore and some messages are lost during the switching process.
I've tested on both 5.8.10 and 7.4.10.
Any ideas ?
Thank you in advance.
El Fatayri Anwar
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
