Hi,
Thanks in advance for reading this, and many thanks to the devs for the
app itself. I hope that someone knowledgeable can point out what I'm
doing wrong or if my expectations are simply unreasonable. If I'm just
completely missing something please point that out as well.
Again, many thanks for your help. This is a prototype setup for what
will be a much larger one (30+ systems) once the kinks are worked out.
Setup:
* Ubuntu 14.04 Server (4.4.0 kernel) - "Sender"
* Ubuntu 14.04 Server (4.4.0 kernel) - "Receiver"
* Rsyslog 8.23.0 via PPA (both)
* The Ubuntu installs are on Hyper-V VMs (Windows 10 Enterprise Host OS)
* Firewalls are off so that I can rule that out as a source of trouble
* Both sender and receiver are running on the same host
Test scenario:
#1) Start "while true" loop on sender
#2) Let it run for a bit, cancel and check results on both nodes
#3) Confirm match on both (good so far)
#4) Start loop again on sender, reboot receiver
#5) Wait for receiver to come back up (under a minute), confirm receiver
is back online, wait just a moment and then stop loop on sender
#6) Check results
#7) Note that 40 additional messages have been logged to the receiver
than is recorded on the sender
See the "test_commands_and_output.txt" link for the exact commands and
output.
I've tried using imtcp, imptcp and imrelp on the receiver, all with the
same results. For the sender, I've tried the traditional
@@REMOTE_IP:PORT syntax and the newer syntax paired with omrelp. For
both approaches I tried setting up a disk-assisted in-memory queue to
support rebooting the client without losing track of what still needs to
be sent to the receiver. It appears that the files are being created,
but the remote message count doesn't appear to be affected without or
without the queue.
Goals:
* The "sender" sends all log entries to the "receiver". If a message
isn't successfully received and acknowledged by the receiver, it is sent
again, either right away or when the receiver comes online again (after
patching and rebooting for instance)
* The "receiver" accepts all log entries and stores in a location
specific to the sender.
Commands run and resulting output:
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/test_commands_and_output.txt
Config files for the "Receiver":
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/receiver/etc/rsyslog.conf
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/receiver/etc/rsyslog.d/50-remote.conf
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/receiver/etc/rsyslog.d/50-default.conf
Config files for the "Senders" (multiple boxes would share this
configuration):
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/senders/etc/rsyslog.conf
*
http://projects.whyaskwhy.org/svn/code_share/rsyslog_log_server/senders/etc/rsyslog.d/50-default.conf
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
