On Fri, 20 Feb 2015, Stoyan Nikolov wrote:
Well, yes, eventually I went ahead and added a discard mark and severity
parameters to start flushing events out.
The problem is that Initially I believed that the queue size would be
dynamic and it will grow as long as queue.MaxDiskSpace is not reached, at
which point it will start discarding events (automagically). Clearly that
is a misunderstanding on my side.
The queue size parameter sets the size of the memory queue, the disk queue is
enabled separately (by setting the filename parameter to tell rsyslog where to
put the queue)
you should enable impstats so that you have info about what is happening with
the queues.
David Lang
One more question: when events are being discarded, what is the default
behavior regarding age of the events? Are older events discarded first or
is it the other way around? Is there a way to manipulate that in some way?
Regards,
Stoyan
On Fri, Feb 20, 2015 at 8:56 AM, Rainer Gerhards <[email protected]>
wrote:
Think about it: what should rsyslog do if the queue is full?
Sent from phone, thus brief.
Am 20.02.2015 05:54 schrieb "Stoyan Nikolov" <[email protected]>:
Thanks for the suggestion!
However, even though I skipped that in my initial mail, I do have a
separate queue, not for the ruleset, but for the action itself.
Processing
halts when that queue gets filled up. Will the behaviour change if i set
queue to be for the ruleset instead of the action?
Regards,
Stoyan
On Feb 20, 2015 1:40 AM, "David Lang" <[email protected]> wrote:
On Thu, 19 Feb 2015, Stoyan Nikolov wrote:
Hi!
I am using rsyslog v. 7.6.7.
I am trying to configure rsyslog to send certain events to a remote
server
over relp and stop processing them further. In order to do so, I set
an
if
condition that, if successful sends events via omrelp. Everything that
does
not match the filter should just go through to the following actions
for
processing. I want to ensure that the events eventually end up in the
remote server, even if it experiences downtime so i use
"action.resumeRetryCount="-1"" in my omrelp action.
My config looks something like:
if ($msg isequal "bla") then call ruleset ruleset1
ruleset(name=ruleset1){
action(type="omrelp" .... action.resumeRetryCount="-1")
stop
}
action2
action3
action4
However, when the omrelp target cannot be reached - this leads to
complete
rsyslog halt, even events that don't match the filter for my omrelp
action
don't get processed.
Is there a way to prevent that?
I want to acheive:
Reliable omrelp logging to a remote server, which may be down for
extended
periods of time - has to be first so that events that are send to the
remote server are not logged via the other actions.
Other logging actions shold not be affected if the omrelp server is
not
reachable.
you need to setup a queue for the ruleset
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
