El 01/10/15 a las 17:46, David Lang escribió:
Rsyslog does have configuration to allow you to discard messages, look
at the high watermark and low watermark setting. You are running a
As I have understood in documentation
(http://www.rsyslog.com/doc/v7-stable/concepts/queues.html), high and
low watermark are used in disk-assisted queues to decide when to write
(or not) to disk.
pretty old version, and probably shoudl upgrade for the best support of
these functions.
I'm using the versions packaged with ubuntu. In ubuntu 12.04 it is 5.x
and in 14.04 it is 7.x. I would prefer to maintain with this "standard"
packages rather than packaging it by myself.
Other than the fact that it may be that your disk queue may not be
working (which just affects how long it can go with the central server
down before you run into trouble), it's doing exactly what you told it
to do.
I want to preserve logs in case of a failure in my central log
servers, but if this failure last longer, then I prefer discarding
messages than hanging my servers.
ok, that takes a bit more effort to configure, but should be doable.
I've been re-reading the documentation. Because I want to preserve log
in case of a failure in my central log, I think I should configure a
limit in the queue, so when this limit was reached, I could discard
messages, shouldn't I?
My doubt with this is that if configuring $ActionQueueDiscardMark (and
$ActionQueueDiscardSeverity) is enough to discard messages when the
queue is full. Or I could avoid those options and use
$ActionQueueTimeoutEnqueue to avoid the lock when the queue is full?
According to this, my configuration would be:
$WorkDirectory /var/spool/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName syslog1_fwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ActionQueueSize 2000 # Limit the queue to 2000 elements (or other value)
$ActionQueueDiscardMark 1900
$ActionQueueDiscardSeverity 5
$ActionQueueTimeoutEnqueue # Really needed? Or should leave out discard
options
*.* :omrelp:syslogserver1.mydomain.com:20514
--
Angel L. Mateo Martínez
Sección de Telemática
Área de Tecnologías de la Información
y las Comunicaciones Aplicadas (ATICA)
http://www.um.es/atica
Tfo: 868887590
Fax: 868888337
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
