On Fri, 31 Oct 2014, Anwar El fatayri wrote:
Hey all,
I wish to have the following centralized logging system :
1) all rsyslog clients should send their logs to a primary server over RELP
2) If the primary server goes down, rsyslog clients should switch to a
secondary rsyslog-RELP server
Config File :
$ModLoad omrelp
### First Part ###$WorkDirectory /var/log/spool # where to place spool
files$ActionQueueFileName fwdrelp # unique name prefix for spool
files$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as
possible)$ActionQueueSaveOnShutdown on # save messages to disk on
shutdown$ActionQueueType LinkedList # run
asynchronously$ActionResumeRetryCount -1 # infinite retries if host is down
### Second Part ###*.* :omrelp:logserver01:6514$ActionExecOnlyWhenPreviousIsSuspended
on& :omrelp:logserver02:6514&
/var/log/localbuffer.log$ActionExecOnlyWhenPreviousIsSuspended off
However, when the primary server goes down, spool files are being generated and
syslog flux is never redirected to the secondary server ==> The rsyslog client
is waiting for the primary server to goes up again in order to resend spool files.
Trying to delete the first part of the config file and use only the second one
solved a part of the problem ==> Failover works and rsyslog automatically
switches between its two destination. However Disk-based buffering is not
configured anymore and some messages are lost during the switching process.
I've tested on both 5.8.10 and 7.4.10.
Any ideas ?
when you tell it to make infinite tries to deliver the messages to a server, it
never fails, so it's not going to fail over to the secondary server. You need to
set a limit to the retries.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
