This probably won't answer your exact question but could you just use keepalived and create a VIP to send the syslog/relp to? Would there be any downside to using a vrrp pool for faul tolerance?
Cheers, JB Original Message From:[email protected] Sent:May 12, 2016 5:10 PM To:[email protected] Reply-to:[email protected] Subject:[rsyslog] configuring failover to work with asynchronous queuing Greetings, We have several hundred RHEL 6 systems running rsyslog 7.4.10 configured to log locally as well as send to a remote rsyslog server via RELP. We want to build some fault tolerance into our system by adding a secondary remote rsyslog server and configuring failover. Early attempts at such a configuration have failed because we are using an asynchronous queuing method (along with infinite retries but that can be changed). The problem with such a configuration is described here: http://blog.gerhards.net/2011/03/using-failover-and-asynchornous-actions.html In that same blog post, Rainer goes on to say that the problem can be worked around by configuring the failover actions without asynchronous processing and encapsulating them in a ruleset that uses asynchronous processing. The omruleset module is mentioned although I think that module is deprecated in our version. I have seen this type of configuration alluded to in other places online, but I have yet to find an actual working example. After working on this for several days, I thought it might be worthwhile to reach out to the community to see if anyone else is doing this successfully. I have been able to make failover function as intended, but it seems that no queuing is occurring when I do so. Here is an example representation of our rsyslog configuration on the sending machines. We have the failover configured, but it obviously does not work. Can anyone provide some guidance on how to modify this configuration to enable failover while still using the asynchronous disk-assisted queuing model that we have in place? ### Modules ### $ModLoad imuxsock $ModLoad imklog $ModLoad omrelp ### Local logging ### $umask 0022 $FileCreateMode 0644 $DirCreateMode 0755 $template DynaLocal,"/var/log/syslog/%SYSLOGFACILITY-TEXT%" *.info -?DynaLocal local0,local1,local2,local3,local4,local5,local6,local7.=debug -?DynaLocal *.err;mail,authpriv,cron,news,local0,local1,local2,local3,local4,local5,local6,local7.none -/var/log/messages ### Some noise filtering before sending remote ### if $syslogfacility-text == 'foo' and $programname == 'foo' and $msg contains 'foo' then stop if $syslogfacility-text == 'bar' and $programname == 'bar' and $msg contains 'bar' then stop if $syslogfacility-text == 'baz' and $programname == 'baz' and $msg contains 'baz' then stop ### Remote logging ### $WorkDirectory /var/lib/rsyslog $ActionQueueFileName fwdRule1 $ActionQueueMaxDiskSpace 1g $ActionQueueSaveOnShutdown on $ActionQueueType LinkedList $ActionResumeRetryCount -1 *.info :omrelp:syslog1.example.com:1514;RSYSLOG_ForwardFormat $ActionExecOnlyWhenPreviousIsSuspended on & :omrelp:syslog2.example.com:1514;RSYSLOG_ForwardFormat $ActionExecOnlyWhenPreviousIsSuspended off Any help would be greatly appreciated. Regards, Andrew Hurt _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
