Hi, I located the problem. After I restarted rsyslog on the central syslog servers ( referred to in the config as *.* @@(o)sys1:514 and *.* @@(o)sys2:514 ) the logging on the local servers started again. Does a remote delivery failure/block cause the clients not to write messages to the local logs?
Best wishes, Sophie > -----Original Message----- > From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of > sophie.loewenthal--- via rsyslog > Sent: Friday, October 05, 2018 11:31 AM > To: rsyslog-users > Cc: LOEWENTHAL Sophie > Subject: [rsyslog] How to syslog to log to both local files (e.g > /var/log/messages) _and_ remotly to syslog server? > > > Hi, > > > I have this line in the /etc/rsyslog.conf: > > $ModLoad imuxsock # provides support for local system logging (e.g. via logger > command) > $ModLoad imjournal # provides access to the systemd journal > $WorkDirectory /var/lib/rsyslog > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > $IncludeConfig /etc/rsyslog.d/*.conf > $OmitLocalLogging on > $IMJournalStateFile imjournal.state > *.info;mail.none;authpriv.none;cron.none /var/log/messages > authpriv.* /var/log/secure > mail.* -/var/log/maillog > cron.* /var/log/cron > *.emerg :omusrmsg:* > uucp,news.crit /var/log/spooler > local7.* /var/log/boot.log > $ModLoad immark > $MarkMessagePeriod 21600 > *.* @@(o)sys1:514 > *.* @@(o)sys2:514 > > The problem is that messages are not logged to the files listed above, but > only > sent to the remote syslog server. I've played a little with this, but seem > to only > manage one or the other: Log remotely over IP, or log locally to files. How > can I > have rsyslog log log to both? > > # rsyslogd -v > rsyslogd 8.24.0, compiled with: > PLATFORM: x86_64-redhat-linux-gnu > PLATFORM (lsb_release -d): > FEATURE_REGEXP: Yes > GSSAPI Kerberos 5 support: Yes > FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes > 64bit Atomic operations supported: Yes > memory allocator: system default > Runtime Instrumentation (slow code): No > uuid support: Yes > Number of Bits in RainerScript integers: 64 > > > Any thoughts would be greatly appreciated. > > Best wishes, > Sophie > > > > > > This message and any attachments (the "message") is > intended solely for the intended addressees and is confidential. > If you receive this message in error,or are not the intended recipient(s), > please delete it and any copies from your systems and immediately notify > the sender. Any unauthorized view, use that does not comply with its purpose, > dissemination or disclosure, either whole or partial, is prohibited. Since the > internet > cannot guarantee the integrity of this message which may not be reliable, BNP > PARIBAS > (and its subsidiaries) shall not be liable for the message if modified, > changed or > falsified. > Do not print this message unless it is necessary, consider the environment. > > -------------------------------------------------------------------------------------------------- > -------------------------------- > > Ce message et toutes les pieces jointes (ci-apres le "message") > sont etablis a l'intention exclusive de ses destinataires et sont > confidentiels. > Si vous recevez ce message par erreur ou s'il ne vous est pas destine, > merci de le detruire ainsi que toute copie de votre systeme et d'en avertir > immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de > ce message qui n'est pas conforme a sa destination, toute diffusion ou toute > publication, totale ou partielle, est interdite. L'Internet ne permettant pas > d'assurer > l'integrite de ce message electronique susceptible d'alteration, BNP Paribas > (et ses filiales) decline(nt) toute responsabilite au titre de ce message dans > l'hypothese > ou il aurait ete modifie, deforme ou falsifie. > N'imprimez ce message que si necessaire, pensez a l'environnement. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
