That general approach is what I recommend in any case.
David Lang
On Thu, 12 May 2016, Joe Blow wrote:
This probably won't answer your exact question but could you just use
keepalived and create a VIP to send the syslog/relp to? Would there be any
downside to using a vrrp pool for faul tolerance?
Cheers,
JB
Original Message
From:[email protected]
Sent:May 12, 2016 5:10 PM
To:[email protected]
Reply-to:[email protected]
Subject:[rsyslog] configuring failover to work with asynchronous queuing
Greetings,
We have several hundred RHEL 6 systems running rsyslog 7.4.10 configured to log
locally as well as send to a remote rsyslog server via RELP.
We want to build some fault tolerance into our system by adding a secondary
remote rsyslog server and configuring failover. Early attempts at such a
configuration have failed because we are using an asynchronous queuing method
(along with infinite retries but that can be changed). The problem with such a
configuration is described here:
http://blog.gerhards.net/2011/03/using-failover-and-asynchornous-actions.html
In that same blog post, Rainer goes on to say that the problem can be worked
around by configuring the failover actions without asynchronous processing and
encapsulating them in a ruleset that uses asynchronous processing. The
omruleset module is mentioned although I think that module is deprecated in our
version.
I have seen this type of configuration alluded to in other places online, but I
have yet to find an actual working example. After working on this for several
days, I thought it might be worthwhile to reach out to the community to see if
anyone else is doing this successfully. I have been able to make failover
function as intended, but it seems that no queuing is occurring when I do so.
Here is an example representation of our rsyslog configuration on the sending
machines. We have the failover configured, but it obviously does not work. Can
anyone provide some guidance on how to modify this configuration to enable
failover while still using the asynchronous disk-assisted queuing model that we
have in place?
### Modules ###
$ModLoad imuxsock
$ModLoad imklog
$ModLoad omrelp
### Local logging ###
$umask 0022
$FileCreateMode 0644
$DirCreateMode 0755
$template DynaLocal,"/var/log/syslog/%SYSLOGFACILITY-TEXT%"
*.info -?DynaLocal
local0,local1,local2,local3,local4,local5,local6,local7.=debug -?DynaLocal
*.err;mail,authpriv,cron,news,local0,local1,local2,local3,local4,local5,local6,local7.none
-/var/log/messages
### Some noise filtering before sending remote ###
if $syslogfacility-text == 'foo' and $programname == 'foo' and $msg contains
'foo' then stop
if $syslogfacility-text == 'bar' and $programname == 'bar' and $msg contains
'bar' then stop
if $syslogfacility-text == 'baz' and $programname == 'baz' and $msg contains
'baz' then stop
### Remote logging ###
$WorkDirectory /var/lib/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
*.info :omrelp:syslog1.example.com:1514;RSYSLOG_ForwardFormat
$ActionExecOnlyWhenPreviousIsSuspended on
& :omrelp:syslog2.example.com:1514;RSYSLOG_ForwardFormat
$ActionExecOnlyWhenPreviousIsSuspended off
Any help would be greatly appreciated.
Regards,
Andrew Hurt
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
