On Tue, 5 Apr 2016, Joe Blow wrote:
So quick question then. How would one add retries to the
@@1.1.1.1:514;template
format of tcp forwarding?
Is the answer to write the rules using the new action queues, or can i
sneak by adding a retries directive to the legacy format?
If you use the legacy format for the action (the @@ format), then the retries
directive also needs to be in the legacy format.
The big problem with the legacy format is figuring out the scope of the various
directives. I don't remember if the retries directive affects all future items
or only the next one (if you do debug output at startup you should be able to
tell)
David Lang
Thanks in advance.
Cheers,
Justin
On Tue, Apr 5, 2016 at 9:35 AM, David Lang <[email protected]> wrote:
On Tue, 5 Apr 2016, Joe Blow wrote:
Hey all,
Had a quick question about when using @@1.1.1.1:514;mytemplate to send
logs
via TCP to another system. If for some reason the sending rsyslog system
cannot touch the TCP socket on the specified remote host, what happens?
Will it try to fire and forget, then move on to the next relevant log
line?
@@ is a reliable transport, so no, it doesn't fire and forget. The details
will vary depending on other config settings (retries, etc), but in
general, processing will halt until the log can be delivered or is
abandoned.
In the same line of questioning, if you have an omelasticsearch output
module which has retries set to 5, if after 5 connections it can't send,
will the logic flow move on down the rsyslog config file?
Yes, after the retries are all made, the delivery of that log message for
that destination is abandoned and rsyslog will move down to the next action.
When you have actions like this that are sending to remote machines that
may be down, you may want to create a new queue (either for the action or
for a ruleset containing multiple actions) that will let the messages move
out of the main queue so that log processing can continue while the
destination is down/slow.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
