Hi, We have multiple central rsyslog servers behind a DNS Round-Robin and a stand alone syslog server as a fallback. I am trying to implement failover with the following configuration.
************ $ModLoad impstats $PStatInterval 60 $PStatSeverity 7 syslog.debug /var/log/rsyslog-stats $RuleSet CentralLogging $MainMsgQueueSize 100000 $MainMsgQueueDiscardMark 90000 $MainMSgQueueDiscardSeverity 3 $RulesetCreateMainQueue on $ActionSendTCPRebindInterval 900 $ActionName dnsrr *.* @@dnsrr;RSYSLOG_SyslogProtocol23Format $ActionExecOnlyWhenPreviousIsSuspended on $ActionName failover & @@fallbackserver;RSYSLOG_SyslogProtocol23Format $ActionExecOnlyWhenPreviousIsSuspended off $InputUDPServerBindRuleset stormcentral $UDPServerRun 514 ************** I tried to test the failover by adding an iptable rule to DROP the outbound packets to current remote server ( one host behind dnsrr ) in use. As expected I see an increase in QueueSize. I was expecting an increase in "failed" metric for dnsrr action and increase in "processed" metric for failover action. But, it did not happen. The Queue size increased and after some time , at May 24 12:58:53 in the log below , I noticed that rsyslogd established new connection to a different host behind DNS RR and drained the Queue. Logs at end of the mail. Rsyslog V7 is the one in use. 1. Shouldn't rsyslog failover to the failover action before waiting for so long and establishing another connection ? 2. If this is the expected behavior, Can I forget the ActionExecOnlyWhenPreviousIsSuspended as rsyslog is itself establishing new connection to a different server behind the DNSRR ( probably calling gethostbyname() again ) 3. I do not have ActionSendTCPRebindInterval set. *********************** May 24 12:39:52 rsyslogd-pstats: CentralLogging: size=0 enqueued=47770 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:39:52 rsyslogd-pstats: dnsrr: processed=47770 failed=0 May 24 12:39:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:40:52 rsyslogd-pstats: CentralLogging: size=0 enqueued=48448 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:40:52 rsyslogd-pstats: dnsrr: processed=48448 failed=0 May 24 12:40:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:41:52 rsyslogd-pstats: CentralLogging: size=660 enqueued=49139 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:41:52 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:41:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:42:52 rsyslogd-pstats: CentralLogging: size=1289 enqueued=49768 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:42:52 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:42:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:43:52 rsyslogd-pstats: CentralLogging: size=2265 enqueued=50744 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:43:52 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:43:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:44:52 rsyslogd-pstats: CentralLogging: size=2963 enqueued=51442 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:44:52 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:44:52 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:45:53 rsyslogd-pstats: CentralLogging: size=3708 enqueued=52187 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:45:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:45:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:46:53 rsyslogd-pstats: CentralLogging: size=4482 enqueued=52961 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:46:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:46:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:47:53 rsyslogd-pstats: CentralLogging: size=5210 enqueued=53689 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:47:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:47:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:48:53 rsyslogd-pstats: CentralLogging: size=5937 enqueued=54416 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:48:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:48:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:49:53 rsyslogd-pstats: CentralLogging: size=6710 enqueued=55189 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:49:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:49:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:50:53 rsyslogd-pstats: CentralLogging: size=7432 enqueued=55911 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:50:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:50:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:51:53 rsyslogd-pstats: CentralLogging: size=8188 enqueued=56667 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:51:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:51:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:52:53 rsyslogd-pstats: CentralLogging: size=8926 enqueued=57405 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:52:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:52:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:53:53 rsyslogd-pstats: CentralLogging: size=9637 enqueued=58116 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:53:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:53:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:54:53 rsyslogd-pstats: CentralLogging: size=10307 enqueued=58786 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:54:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:54:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:55:53 rsyslogd-pstats: CentralLogging: size=10977 enqueued=59456 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:55:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:55:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:56:53 rsyslogd-pstats: CentralLogging: size=11653 enqueued=60132 full=0 discarded.full=0 discarded.nf=0 maxqsize=11819 May 24 12:56:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:56:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:57:53 rsyslogd-pstats: CentralLogging: size=12323 enqueued=60802 full=0 discarded.full=0 discarded.nf=0 maxqsize=12323 May 24 12:57:53 rsyslogd-pstats: dnsrr: processed=48480 failed=0 May 24 12:57:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:58:53 rsyslogd-pstats: CentralLogging: size=0 enqueued=61523 full=0 discarded.full=0 discarded.nf=0 maxqsize=12479 May 24 12:58:53 rsyslogd-pstats: dnsrr: processed=61523 failed=0 May 24 12:58:53 rsyslogd-pstats: failover: processed=0 failed=0 May 24 12:59:53 rsyslogd-pstats: CentralLogging: size=0 enqueued=62150 full=0 discarded.full=0 discarded.nf=0 maxqsize=12479 May 24 12:59:53 rsyslogd-pstats: dnsrr: processed=62150 failed=0 May 24 12:59:53 rsyslogd-pstats: failover: processed=0 failed=0************************************ -- Thanks Karri _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
