On Fri, 23 Dec 2016, at 19:16, Woodruff, Dan wrote: > Then later on if you want to get real fancy, you can set up a queue on > the > ForwardToQRadar ruleset so when QRadar is down for patching logs will be > buffered and forwarded once QRadar is back up. I just got this worked a > few > weeks ago and can share the full ruleset config if you're interested. > > Hope that helps, > Dan
An example of buffer/forward would be super interesting - please share Dan. A+ Dave _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
