2015-02-02 11:22 GMT+01:00 Makimoto <[email protected]>: > Hi > > Good catch!, but no dice :( > > But now I'm thinking: should I see the spool files on /var/lib/rsyslog? >
Not as long as the in-memory queue is sufficient. But with the config sample you posted, you won't see any because you've commented out the queue mode, so it is a direct queue (aka "no queue"), > I see none, when rsyslog is running. > > If anyone sees any obvious flaws, please let me know, as this driving me up > the wall... > > > a debug log should give pretty good insight as this seems to be reproducible each time: http://www.rsyslog.com/doc/master/troubleshooting/debug.html#enabling-debug-via-rsyslog-conf HTH Rainer On 2 February 2015 at 09:26, David Lang <[email protected]> wrote: > > > On Mon, 2 Feb 2015, Makimoto wrote: > > > > Hi all > >> > >> I was wondering if you could help me to troubleshoot what is going on a > >> freshly installed redhat 6.6 box. > >> > >> [root@lotus_live_proxy etc]# rsyslogd -v > >> rsyslogd 7.4.10, compiled with: > >> FEATURE_REGEXP: Yes > >> FEATURE_LARGEFILE: No > >> GSSAPI Kerberos 5 support: Yes > >> FEATURE_DEBUG (debug build, slow code): No > >> 32bit Atomic operations supported: Yes > >> 64bit Atomic operations supported: Yes > >> Runtime Instrumentation (slow code): No > >> uuid support: Yes > >> > >> This was originally v5, but as I hit problems that made no sense, I > bumped > >> up versions. > >> > >> The issue I'm having is quite simple. I have 2 boxes where I send logs > to. > >> In this machine, only one destination at a time works. > >> As soon as I add the other destination, rsyslog won't even log locally. > >> > >> So I've got 2 blocks of in my config. > >> > >> # ### begin forwarding rule 1 ### TCP to central logging server > >> $WorkDirectory /var/lib/rsyslog # where to place spool files > >> $ActionQueueFileName fwdRule1 # unique name prefix for spool files > >> $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as > >> possible) > >> $ActionQueueSaveOnShutdown on # save messages to disk on shutdown > >> #$ActionQueueType LinkedList # run asynchronously > >> $ActionResumeRetryCount -1 # infinite retries if host is down > >> *.* @@192.168.232.1:601 > >> # ### end of the forwarding rule 1 ### > >> > >> I've got another identical block with a different destination. If I > >> uncomment the other one, rsyslog goes silent. > >> > > > > when you say 'identical block' does that include the ActionQueueFileName? > > If so, that's going to be your problem. That filename needs to be unique > > for each one. > > > > David Lang > > > > Both destinations are reachable, and there's a listening service there. > >> I've have this exact config file working on other boxes. > >> This is the only redhat 6.6 box I've got though. > >> > >> I've posted a debug log at http://pastebin.com/fdmAamRh > >> > >> Any help, pointers, directions or anything at all very much appreciated. > >> > >> > >> > >> _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > > > > -- > =============== > Gnothi Seauton > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
