david> why are you trying to split them? all logs get processed by all
rules by
david> default, so if the aggregators forward their logs, they will also
forward logs
david> they receive.
The config files are being pushed out by puppet, so keeping the files
themselves separate makes life much easier because we can use two
different templates. We also don't *want* all logs processed by all
rules, since we don't want the logs coming from the client to be logged
on the disk of the aggregation server. That was the first iteration I
tried and would be a great way to fill up the local disks on the
aggregators with information we don't want to keep there.
david> Using the legacy format, you are not achieving what you think you
are. You are creating a large and
david> complex queue to write to a local file and will completely stall
if the remote system is down.
I took the queue configuration lines from the hosted syslog site's
suggestions page.
david> All of this would be obvious with the new style config.
Okay, I'm not at all clear on how to write what I need in the new style
config. Suggestions on how to translate?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
