Btw, I'm not sure if this will work - I've tried omrelp module which supposed to work this way too - and it looses messages when connection is not available.
On Tue, Apr 5, 2016 at 8:36 AM, David Lang <[email protected]> wrote: > On Tue, 5 Apr 2016, Joe Blow wrote: > > So quick question then. How would one add retries to the >> @@1.1.1.1:514;template >> format of tcp forwarding? >> >> Is the answer to write the rules using the new action queues, or can i >> sneak by adding a retries directive to the legacy format? >> > > If you use the legacy format for the action (the @@ format), then the > retries directive also needs to be in the legacy format. > > The big problem with the legacy format is figuring out the scope of the > various directives. I don't remember if the retries directive affects all > future items or only the next one (if you do debug output at startup you > should be able to tell) > > David Lang > > > Thanks in advance. >> >> Cheers, >> >> Justin >> >> On Tue, Apr 5, 2016 at 9:35 AM, David Lang <[email protected]> wrote: >> >> On Tue, 5 Apr 2016, Joe Blow wrote: >>> >>> Hey all, >>> >>>> >>>> Had a quick question about when using @@1.1.1.1:514;mytemplate to send >>>> logs >>>> via TCP to another system. If for some reason the sending rsyslog >>>> system >>>> cannot touch the TCP socket on the specified remote host, what happens? >>>> >>>> Will it try to fire and forget, then move on to the next relevant log >>>> line? >>>> >>>> >>> @@ is a reliable transport, so no, it doesn't fire and forget. The >>> details >>> will vary depending on other config settings (retries, etc), but in >>> general, processing will halt until the log can be delivered or is >>> abandoned. >>> >>> In the same line of questioning, if you have an omelasticsearch output >>> >>>> module which has retries set to 5, if after 5 connections it can't send, >>>> will the logic flow move on down the rsyslog config file? >>>> >>>> >>> Yes, after the retries are all made, the delivery of that log message for >>> that destination is abandoned and rsyslog will move down to the next >>> action. >>> >>> When you have actions like this that are sending to remote machines that >>> may be down, you may want to create a new queue (either for the action or >>> for a ruleset containing multiple actions) that will let the messages >>> move >>> out of the main queue so that log processing can continue while the >>> destination is down/slow. >>> >>> David Lang >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
