Firstly, after you confirm that your queueing works properly, I'd advise
you to switch to RELP so you have "more reliability".
But regarding your setup - as you defined
$WorkDirectory /var/spool/rsyslog
Your queue should be placed there.
Question is whether you do indeed have such directory in your system.
Because if you don't, the rsyslog daemon won't be able to save the queue
contents.
But in case of just a few messages you shouldn't be saving the contents
do disk at all. (it would be saved when you have unsent messages and
shut down the rsyslog daemon).
Also, notice that
https://www.rsyslog.com/doc/master/configuration/action/rsconf1_repeatedmsgreduction.html
"This parameter models old sysklogd legacy. *Note that many people,
including the rsyslog authors, consider this to be a misfeature.* See
/Discussion/ below to learn why."
But in general, the setup should work... with one caveat. Your "never"
might in fact not be "never". You didn't tweak the settings that control
action resuming so they are at default 30 second initial interval which
is getting raised after every 10 tries up to a default 1800 seconds. So
if the server was off for long enough, the client might simply have
paused sending for a really significant time.
See the description of parameters at
https://www.rsyslog.com/doc/v8-stable/configuration/actions.html#general-action-parameters.
You might set (just for test! you probably don't want to set it in prod
for that often)
$ActionResumeInterval 1
And then run your client instance in debug mode to see interactively
what it's trying to do.
rsyslogd -f rsyslog.conf -i NONE -n -d
On 17.02.2022 18:03, MACGREGOR Will via rsyslog wrote:
I'm new to rsyslog, and I'm trying to set up reliable forwarding of syslog
messages with rsyslog according to these instructions:
https://www.rsyslog.com/doc/master/tutorials/reliable_forwarding.html
I confirm that remote logging is working initially by doing
# logger "hello, world"
on the client, and verifying that this message shows up in the server (in this
case in /var/log/syslog)
I then shut down the rsyslog server, and log a few more messages on the client.
As expected, these are not showing up on the server side any more. On the
client, they seem to be going to its /var/log/syslog file; I have no idea where
(if) they're being queued.
I then re-enable the rsyslog server, but the entries that I wrote on the client
never seem to make it back to the server. What am I doing wrong?
Some configuration files:
--------------------------------------------------------------------------------------------
client rsyslog.conf file:
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
#
/usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# setup reliable local buffering
#
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
*.* @@<redacted>:514
------------------------------------------------------------------
server rsyslog.conf file
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
#
/usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
------------------------------------------------------------------
version info for rsyslogd (both machines running Ubuntu 18.04, FWIW)
# rsyslogd -version (same version for both client and server)
rsyslogd 8.32.0, compiled with:
PLATFORM: x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
systemd support: Yes
Number of Bits in RainerScript integers: 64
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Followhttps://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
