On Wed, 16 Mar 2016, Eugene Prokopiev wrote:
2016-03-16 11:05 GMT+03:00 David Lang:
This probably means that rsyslog doesn't have permissions to create files in
the workdir, does this system have SELinux or AppArmor on it, they may not
be allowing access to /var/spool/rsyslog
This was a strange problem with files in /var/spool/rsyslog, they
looked like corrupt. Deleteing resolved this problem.
When you start working with queues, it's really a good idea to switch over
to the new style syntax. Among other things it lets you name things, so
instead of 'action 2' which means the second output statement in the file,
you can call it 'pg' or something like that.
I like new style syntax, but it is not possible now to use it with
postgresql - https://github.com/rsyslog/rsyslog/issues/818
Is it possible to increase queue size with old syntax?
Yes, as part of the queue definition there is an actionqueuesize or something
like that.
you can also create a ruleset and put a queue on the ruleset with the new
syntax, then put the postgres output in that ruleset. It's not as pretty as the
new action() syntax directly, but it's a lot better than the old queue syntax.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
