Thanks for the suggestion! However, even though I skipped that in my initial mail, I do have a separate queue, not for the ruleset, but for the action itself. Processing halts when that queue gets filled up. Will the behaviour change if i set queue to be for the ruleset instead of the action?
Regards, Stoyan On Feb 20, 2015 1:40 AM, "David Lang" <[email protected]> wrote: > On Thu, 19 Feb 2015, Stoyan Nikolov wrote: > > Hi! >> >> >> I am using rsyslog v. 7.6.7. >> >> I am trying to configure rsyslog to send certain events to a remote server >> over relp and stop processing them further. In order to do so, I set an if >> condition that, if successful sends events via omrelp. Everything that >> does >> not match the filter should just go through to the following actions for >> processing. I want to ensure that the events eventually end up in the >> remote server, even if it experiences downtime so i use >> "action.resumeRetryCount="-1"" in my omrelp action. >> >> My config looks something like: >> >> if ($msg isequal "bla") then call ruleset ruleset1 >> >> ruleset(name=ruleset1){ >> action(type="omrelp" .... action.resumeRetryCount="-1") >> stop >> } >> >> action2 >> action3 >> action4 >> >> However, when the omrelp target cannot be reached - this leads to complete >> rsyslog halt, even events that don't match the filter for my omrelp action >> don't get processed. >> >> Is there a way to prevent that? >> >> I want to acheive: >> >> Reliable omrelp logging to a remote server, which may be down for extended >> periods of time - has to be first so that events that are send to the >> remote server are not logged via the other actions. >> >> Other logging actions shold not be affected if the omrelp server is not >> reachable. >> > > you need to setup a queue for the ruleset > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
