So quick question then. How would one add retries to the @@1.1.1.1:514;template format of tcp forwarding?
Is the answer to write the rules using the new action queues, or can i sneak by adding a retries directive to the legacy format? Thanks in advance. Cheers, Justin On Tue, Apr 5, 2016 at 9:35 AM, David Lang <[email protected]> wrote: > On Tue, 5 Apr 2016, Joe Blow wrote: > > Hey all, >> >> Had a quick question about when using @@1.1.1.1:514;mytemplate to send >> logs >> via TCP to another system. If for some reason the sending rsyslog system >> cannot touch the TCP socket on the specified remote host, what happens? >> >> Will it try to fire and forget, then move on to the next relevant log >> line? >> > > @@ is a reliable transport, so no, it doesn't fire and forget. The details > will vary depending on other config settings (retries, etc), but in > general, processing will halt until the log can be delivered or is > abandoned. > > In the same line of questioning, if you have an omelasticsearch output >> module which has retries set to 5, if after 5 connections it can't send, >> will the logic flow move on down the rsyslog config file? >> > > Yes, after the retries are all made, the delivery of that log message for > that destination is abandoned and rsyslog will move down to the next action. > > When you have actions like this that are sending to remote machines that > may be down, you may want to create a new queue (either for the action or > for a ruleset containing multiple actions) that will let the messages move > out of the main queue so that log processing can continue while the > destination is down/slow. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
