> > >>> So rsyslog processes the messages and says it is writing it out, but > >>> they aren't there. > >> > >> the only time I've seen this happen is if asyncwrites are enabled (in which > >> case they will show up after rsyslog gets a HUP), can you show what > action > >> 20's full output line is? > > > Something more than this? > > no, I was asking what the action() line is (you may have sent it earlier in the > thread, but I am agressive in deleting messages that I've replied to)
Ah, gotcha. Here are the template and action lines:
template(name="EduroamACSFile" type="string"
string="/var/log/collection/eduroam_acs.log")
template(name="EduroamACSFormat" type="string" string="%timestamp%
%hostname% %syslogtag%%msg:::escape-cc%\n")
/tmp/debug.log;RSYSLOG_DebugFormat
action(type="omfile" dynaFile="EduroamACSFile"
template="EduroamACSFormat" name="writeEduroamACSFile")
>
> > I have all my actions named now, main queue size increased to 500k, and
> I've
> > attempted using TCP from this particular problem log source, but the
> sending
> > device is not sending messages when set to TCP, so I'm going to change
it
> > back to UDP. Other than that, I'm going to let this ride until tomorrow
to
> > gather more impstats output before I report back.
>
> sounds good.
>
> If you can't send via TCP, double check that there is a route back to the
> source
> from the syslog server. If there isn't, UDP won't get through to the app
either
> (which doesn't explain some messages getting through and not others, but
> there's
> been so much changing that it's possible that we're now testing from
> somewhere
> that has never worked)
>
Right, I've been changing a lot. I do have a route back to the source -
confirmed with a ping.
Thanks,
Dan
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
