On Sat, 25 Mar 2017, Chris wrote:
On Fri, Mar 24, 2017, at 09:50 PM, David Lang wrote:
On Fri, 24 Mar 2017, Chris wrote:
On RH 6 systems running rsyslog 5.8.10 we noticed that if we setup a
client system to use TCP to log to a remote server:
*.* @@192.168.1.2
If the remote log server is not reachable for some reason no logging
takes place, not even local logging to the local system log files.
When the log server is available and rsyslog is restarted both local
logging and remote logging work. Is this a known issue or is there some
way to ensure that local logging still occurs when the TCP remote
server is down?
This is working as designed (for the config you specified), if a message
cannot
be delivered to one destination, and you don't have rsyslog configured to
throw
it away, it is not able to finish processing that log message and start
work on
the next one.
You can create an action queue for the delivery to a remote system, and
until
that queue fills up, other log processing will continue.
You really should move to at least v7, if not v8, a lot of things have
changed,
especially the available syntax for specifying queues.
David Lang
Thank you for the response. Unfortunately we need to stay with the
version that came with the OS for now. Internal compliance
requirements.
What I'd like to do is setup all the clients to log to both the remote
server (TCP) and the local logs. When the remote TCP server is not
available, I want it to continue to log to the local logs. Pretty new
to more advanced rsyslog configurations, we've always just done the
basic.
Can you point me in the right direction on how to go about this?
look in the documentation that comes with your distro for action queue
configuration. 5.8 is ancient, your distro should have some option for running a
later version if it's still supported.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
