On Thu, 23 Jul 2015, Randall Diffenderfer wrote:
i am interested in how i can tell when events that i care about are or
have happened.
the scenario is:
i gather logs on one host. i use 'omfwd' via tcp to another host, no RELP
in play. pstats enabled/captured "out of band" (as in direct to file) on
both ends.
assume "steady state" is loglines are being generated on the sending host
and sent successfully to the receiving host.
how can i ascertain various "state" changes? examples include "rcv system
unreachable", "rcv system slow" causing logline backup, "sending system
exceeds DA space limits", etc.
what are the indicators i can look to here? any helpful hints would be
greatly appreciated!
on the sending system, look for log messages from rsyslog about suspended
outputs
in the pstats you will see suspended outputs when the remote system is not
available, and you will see the queue size climb if the receiving system can't
keep up.
there are log messages when you run out of DA space (assuming that the log
message can still be written locally) and the queue size in the pstats will hit
the max size allowed.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
