On Tue, 5 Apr 2016, Kane Kim wrote:
Btw, I'm not sure if this will work - I've tried omrelp module which
supposed to work this way too - and it looses messages when connection is
not available.
As long as you have retries set to -1, relp is not supposed to loose any
messages if the remote system is down. There is a report that it looses one
message per restart on the sending system, but if you are loosing messages based
on the receiving system being down, check your retries and timeout settings.
David Lang
On Tue, Apr 5, 2016 at 8:36 AM, David Lang <[email protected]> wrote:
On Tue, 5 Apr 2016, Joe Blow wrote:
So quick question then. How would one add retries to the
@@1.1.1.1:514;template
format of tcp forwarding?
Is the answer to write the rules using the new action queues, or can i
sneak by adding a retries directive to the legacy format?
If you use the legacy format for the action (the @@ format), then the
retries directive also needs to be in the legacy format.
The big problem with the legacy format is figuring out the scope of the
various directives. I don't remember if the retries directive affects all
future items or only the next one (if you do debug output at startup you
should be able to tell)
David Lang
Thanks in advance.
Cheers,
Justin
On Tue, Apr 5, 2016 at 9:35 AM, David Lang <[email protected]> wrote:
On Tue, 5 Apr 2016, Joe Blow wrote:
Hey all,
Had a quick question about when using @@1.1.1.1:514;mytemplate to send
logs
via TCP to another system. If for some reason the sending rsyslog
system
cannot touch the TCP socket on the specified remote host, what happens?
Will it try to fire and forget, then move on to the next relevant log
line?
@@ is a reliable transport, so no, it doesn't fire and forget. The
details
will vary depending on other config settings (retries, etc), but in
general, processing will halt until the log can be delivered or is
abandoned.
In the same line of questioning, if you have an omelasticsearch output
module which has retries set to 5, if after 5 connections it can't send,
will the logic flow move on down the rsyslog config file?
Yes, after the retries are all made, the delivery of that log message for
that destination is abandoned and rsyslog will move down to the next
action.
When you have actions like this that are sending to remote machines that
may be down, you may want to create a new queue (either for the action or
for a ruleset containing multiple actions) that will let the messages
move
out of the main queue so that log processing can continue while the
destination is down/slow.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
