On Tue, 5 Apr 2016, Joe Blow wrote:
Hey all,
Had a quick question about when using @@1.1.1.1:514;mytemplate to send logs
via TCP to another system. If for some reason the sending rsyslog system
cannot touch the TCP socket on the specified remote host, what happens?
Will it try to fire and forget, then move on to the next relevant log
line?
@@ is a reliable transport, so no, it doesn't fire and forget. The details will
vary depending on other config settings (retries, etc), but in general,
processing will halt until the log can be delivered or is abandoned.
In the same line of questioning, if you have an omelasticsearch output
module which has retries set to 5, if after 5 connections it can't send,
will the logic flow move on down the rsyslog config file?
Yes, after the retries are all made, the delivery of that log message for that
destination is abandoned and rsyslog will move down to the next action.
When you have actions like this that are sending to remote machines that may be
down, you may want to create a new queue (either for the action or for a
ruleset containing multiple actions) that will let the messages move out of the
main queue so that log processing can continue while the destination is
down/slow.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
