Hello,
I'm trying to configure a queue to send logs to a remote relp rsyslog
server. This is my rule:
$RuleSet relp
if re_match($hostname,'^canis[0-9]+$') and $programname == 'slapd' then {
set $!appname = "ldap.um.es" ;
action(type="omrelp"
action.resumeRetryCount="-1"
target="relp.um.es"
port="20514"
template="lagar_json"
queue.spoolDirectory="/var/spool/rsyslog"
queue.type="LinkedList"
queue.filename="lagar_telematica_canis_fwd"
queue.maxdiskspace="10M"
queue.saveonshutdown="on"
queue.size="10000"
queue.discardmark="9900"
queue.dicardseverity="5"
)
}
$RuleSet RSYSLOG_DefaultRuleset
My problem is that masdiskspace option is ignored and no discard of
messages is done. I'm producing log messages and at this moment I have
15 queue files 10MB (aprox.) each (that is, about 150MB).
I have tried with legacy syntax:
$RuleSet relp
if re_match($hostname,'^canis[0-9]+$') and $programname == 'slapd' then {
set $!appname = "ldap.um.es" ;
$WorkDirectory /var/spool/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName lagar_telematica_canis_fwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ActionQueueMaxDiskSpace 10M
$ActionQueueSize 10000
$ActionQueueDiscardMark 9900
$ActionQueueDiscardSeverity 5
*.* :omrelp:relp.um.es:20514;lagar_json
}
and with this configuration when it reaches 10 queue files of 1MB each
(except the last of about 500K) then no more queue files are created and
messages are discarded.
What am I doing wrong in the first configuration? Any help?
Thank you.
--
Angel L. Mateo Martínez
Sección de Telemática
Área de Tecnologías de la Información
y las Comunicaciones Aplicadas (ATICA)
http://www.um.es/atica
Tfo: 868889150
Fax: 868888337
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
