OK, patience, it appears, is the watchword. I had to wait for about 10 minutes before rsyslog started forwarding properly. SHeesh.
RB ________________________________________ From: [email protected] [[email protected]] on behalf of Randy Baca [[email protected]] Sent: Wednesday, October 14, 2015 1:58 PM To: rsyslog-users Subject: Re: [rsyslog] Complex forwarding and spoofing question Thank you for all the help getting this architecture working. All is going well except now that we are rolling it out to a second and third site we are only getting a subset of events forwarded. On the inbound side we are seeing logs from a dozen hosts on udp/514, about 100 events per second overall. On the forward side, only about 10 to 20 events every 30 seconds or so are being sent. Both the localhost on udp/515 and the remote host on tcp/514 are getting the same events forwarded. It is almost as if the rsyslog service intermittently grabs a few logs and forwards them about every 30 seconds. Any ideas? Thanks, RB _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
