I guess I am missing how this helps with fail over not working. It seems that it never tries to send to the second server when the first is not available.
On Fri, May 25, 2018, at 6:22 AM, Peter Viskup wrote: > Read queue documentation [1]. Search for discard, watermark and size > parameters to limit the FS storage. Anyway sizing of queue is not as > easy. At first you have to count approx. +350-500B of metadata per one > message in queue. > Good luck. > > [1] https://www.rsyslog.com/doc/v8-stable/rainerscript/queue_parameters.html > > Peter > > On Fri, May 25, 2018 at 1:35 PM, rsyslog--- via rsyslog > <[email protected]> wrote: > > Anyone have any insight on this? Maybe some things to look at? This > > setup does not fail to the other server. > > > > On Sun, May 20, 2018, at 12:40 PM, rsyslog--- via rsyslog wrote: > >> I am in the preliminary stages of creating a failover rsyslog.conf for> > >> all our Redhat 6 and 7 clients (default rsyslogd 5.8.10 and 8.24.0), > >> using this page (and others) as a starting point, but I am > >> unable to get> the failover to work on either version. > >> https://www.rsyslog.com/doc/master/tutorials/failover_syslog_server.html> > >> Here is the basic config the top section is pretty standard what ships> > >> with Redhat 6: > >> $ModLoad imuxsock > >> $ModLoad imklog > >> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > >> $IncludeConfig /etc/rsyslog.d/*.conf > >> > >> *.info;mail.none;authpriv.none;cron.none > >> /var/log/messages> authpriv.* > >> /var/log/secure> mail.* - > >> /var/log/maillog> cron.* > >> /var/log/cron> *.emerg * > >> uucp,news.crit > >> /var/log/spooler> local7.* > >> /var/log/boot.log> > >> ### Failover #### > >> *.* @@192.168.1.10:616 > >> $ActionExecOnlyWhenPreviousIsSuspended on > >> & @@192.168.1.11:616 > >> & /var/log/localbuffer > >> $ActionExecOnlyWhenPreviousIsSuspended off > >> > >> To test I run a simple for loop and write about a 1000 lines in /var/> > >> log/messages and monitor traffic to both remote servers. I then place> an > >> outbound Iptables rule to block all access to .10. Logging > >> in /var/> log/messages stops after about 200 or so lines and nothing is > >> ever sent> to the second (.11) server. Thinking that maybe the Iptables > >> rule may> not accurately reflect a unreachable server, I unplugged the > >> Ethernet> cable on .10 and the failover still does not work. > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by > >> a myriad> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > >> if you> DON'T LIKE THAT. > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
