Hi

I seem to be running into an issue with rsyslog 8.32.0 running on
Ubuntu 14.04.  I have actions configured to fire when the previous
action is suspended, and was working fine with the version included
with Ubuntu (7.4.4). After upgrading to 8.32.0 via the PPA this no
longer works, the action.execOnlyWhenPreviousIsSuspended parameter no
longer appears to be triggering.  With the configuration snippet I
included below, I would expect the actions named “penny” and
“dreadful” to become suspended (due to the remote servers not
existing) but only the first action is triggered despite it becoming
suspended.  Am I doing something wrong?

Config extract:

module(load="omprog")

$template event_json,"%msg:2:$%\n"
$template empty,""

ruleset(name="sendEventLogs") {
    action(
        name="penny"
        type="omfwd"
        target=“172.29.21.42"
        port="10514"
        StreamDriver="gtls"
        StreamDriverMode="1"
        StreamDriverAuthMode="x509/name"
        StreamDriverPermittedPeers=“172.29.21.42”
        protocol="tcp"
        queue.type="LinkedList"
        queue.filename="event_172.29.21.42"
        queue.saveonshutdown="on"
        queue.maxdiskspace="1G"
        queue.timeoutenqueue="0"
        # action.resumeRetryCount="-1"
        action.reportSuspension="on"
        action.reportSuspensionContinuation="on"
        template="event_json"
    )
    action(
        name="dreadful"
        type="omfwd"
        target="host2.example.com"
        port="10514"
        StreamDriver="gtls"
        StreamDriverMode="1"
        StreamDriverAuthMode="x509/name"
        StreamDriverPermittedPeers="host2.example.com"
        protocol="tcp"
        queue.type="LinkedList"
        queue.filename=“event_host2.example.com"
        queue.saveonshutdown="on"
        queue.maxdiskspace="1G"
        queue.timeoutenqueue="0"
        # action.resumeRetryCount="-1"
        action.reportSuspension="on"
        action.reportSuspensionContinuation="on"
        action.execOnlyWhenPreviousIsSuspended="on"
        template="event_json"
    )
    action(
        name="jessica"
        type="omprog"
        binary="/opt/platform/apps/services/audit_failure.sh"
        template="empty"
        action.reportSuspension="on"
        action.execOnlyWhenPreviousIsSuspended="on"
        action.execOnlyOnceEveryInterval="600"
    )
}

if $programname contains 'event' then {
    call sendEventLogs
    stop
}

Log messages

2018-02-07T12:46:17.448360+00:00 NICVW-STANDALONE-172 rsyslogd:
[origin software="rsyslogd" swVersion="8.32.0" x-pid="236951"
x-info="http://www.rsyslog.com";] start
2018-02-07T12:48:24.015625+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:48:24.015633+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), retry 0. There should be
messages before this one giving the reason for suspension. [v8.32.0
try http://www.rsyslog.com/e/2007 ]
2018-02-07T12:50:31.246040+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:50:31.246262+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
12:51:01 2018, retry nbr 0. There should be messages before this one
giving the reason for suspension. [v8.32.0 try
http://www.rsyslog.com/e/2007 ]
2018-02-07T12:52:38.478031+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:52:38.478365+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), retry 1. There should be
messages before this one giving the reason for suspension. [v8.32.0
try http://www.rsyslog.com/e/2007 ]
2018-02-07T12:54:45.710029+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:54:45.710363+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
12:55:15 2018, retry nbr 1. There should be messages before this one
giving the reason for suspension. [v8.32.0 try
http://www.rsyslog.com/e/2007 ]
2018-02-07T12:57:23.278087+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:57:23.278397+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
12:57:53 2018, retry nbr 2. There should be messages before this one
giving the reason for suspension. [v8.32.0 try
http://www.rsyslog.com/e/2007 ]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to