Hi all !
I'm currently doing some tests on several log shipper softwares.
The idea is to have a fault tolerant solution. Load balancing would have been
even better.
We can't lose data and no duplicates are allowed.
So i immediately thought to the RELP protocole which is known to be reliable.
Unfortunately i found only one way to provide a failover with rsyslog. See
configuration below :
Client machine :
----------------
module(load="omrelp")
if $programname startswith 'Mytag.' then {
action(Name="host1"
Type="omrelp"
Target="10.29.2.199"
Port="20514"
Action.ResumeInterval="5"
Timeout="5")
action(Name="host2"
Type="omrelp"
Target="10.29.2.200"
Port="20514"
Action.ExecOnlyWhenPreviousIsSuspended="on"
Action.ResumeInterval="5"
Timeout="5")
}
Server :
module(load="imrelp")
input(type="imrelp" port="20514")
if $programname startswith 'Mytag.' then {
action(type="omfwd"
target="127.0.0.1"
port="20515"
protocol="tcp"
queue.filename="forward-localhost"
queue.spoolDirectory="/tmp"
queue.size="100"
queue.type="LinkedList")
}
This configuration doesn't work as expected.
I did a couple of tests by sending 2000 unique log lines and by killing
(SIGKILL) the master server then reenabling.
In the source machine :
wc -l uniq_lines.log
2000 uniq_lines.log
In the master server :
cat 142*|wc -l
5078
sort -u 142*|wc -l
2000
In the slave :
sort -u 142*|wc -l
647
Obviously some lines have been duplicated.
Is there a way to keep a failover architeture without duplicating logs please ?
By the way, in normal operation (without failure) it is perfectly reliable.
I've sent 1 000 000 of lines without loosing/duplicating.
rsyslog version : 8.7.0
Regards,
Smana
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
