Hi guys,
Could you please help me to find out the proper configuration for the following
use case ?
* We have multiple datacenters
* All our logs are sent to a central analytic platform
* In each dc we'd like to have a spooling server which will keep to logs in
case of network failure.
* All the logs from the sources servers have to be sent to the spooling server
(no spooling on source servers)
* Relp if it's possible
To summarize :
source servers -> spooling server -> analytics plateform
I tried to use relp but when the destination (analytics pf) is unreachable all
the log flow slows down, even on source servers.
With tcp the source server keeps to send but i don't see my spooling space
growing. I presume i'm loosing data (i'll do further tests)
When i use the option "action.resumeRetryCount="-1" when the destination is
uncheachable the log flow stops completely...
Here is my current configuration
Source server:
module(load="impstats"
format="json"
interval="60"
log.syslog="off"
log.file="/var/log/rsyslog-stats.log"
severity="7")
module(load="imtcp")
input(type="imtcp" port="514")
if $programname startswith 'foo.' then @@bar.domain.tld:514
Spooling server:
module(load="imtcp")
input(type="imtcp" port="514")
module(load="impstats"
format="json"
interval="60"
log.syslog="off"
log.file="/var/log/rsyslog-stats.log"
severity="7")
if $programname startswith 'foo.' then {
action(type="omfwd"
action.resumeRetryCount="-1"
name="spooling"
target="analytics"
port="514"
protocol="tcp"
queue.filename="eggforward"
queue.spoolDirectory="/var/spool/rsyslog"
queue.type="LinkedList")
}
Thanks for your help
Smana
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
