It should be a syslog.=err message. General advise is to record syslog.* because otherwise you don't know anything about rsyslog state. It's a mystery to me why distros by default discard these messages...
HTH Rainer 2015-02-28 18:17 GMT+01:00 Anoop Karollil <[email protected]>: > Hello, > > I am trying to find an easy way to monitor rsyslog forwarding failures. Is > there a log that forward failure messages are written to? > > I checked the debugging section and I can see a forward failure I > simulated when I run syslog in debug mode: > > 4960.357840852:6ade3f983700: 172.16.252.1:514/udp > 4960.357862435:6ade3f983700: sendto() error: 1 = Operation not permitted. > 4960.357878638:6ade3f983700: error forwarding via udp, suspending > > http://www.rsyslog.com/doc/omfwd.html talks about maxErrorMessages > and how omfwd will emit an error for forwarding errors. Where does it > emit the error to? Its fed back to rsyslog's input message stream - does > that show up anywhere? > > Or maybe I should be using impstats? > > I am using rsyslog version 5.8.6 (Ubuntu 12.04) > > Thanks! > Anoop > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
