right, but the following doesn't setup buffering on the implied ruleset, it sets
it up on the first action in the first file found /etc/rsyslog.d/*.conf
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
yes, setting up an action on the ruleset works, but I don't think that's
supported in the legacy format at all
David Lang
On Fri, 18 Feb 2022, Mariusz Kruk via rsyslog wrote:
My bad. I meant that both actions are within the same main implied ruleset as
far as I understand the legacy format.
Anyway, just to be on the safe side, I'd do a separate "output" ruleset with
its own queue and within that ruleset I'd do the output action.
That does work. I have several dozens hosts working like that.
On 18 February 2022 22:51:54 CET, David Lang <[email protected]> wrote:
On Fri, 18 Feb 2022, Mariusz Kruk via rsyslog wrote:
I'm not fully sure, however, since you use the legacy config format what's
the interaction between both actions within the same queue. In order to be
sure to have proper queueing _on the forwarding action_ I'd do a separate
queue for this omfwd (or omrelp or whatever you're gonna use in the end)
action alone.
you can't have one queue for multiple actions, you can have a queue on a ruleset
that contains multiple actions, but a queue on one action is only on that one
action.
This is one of the reasons that the legacy format is discouraged for this sort
of thing. In the new format where the queue is part of the action() statement,
it is very clear that the queue is only on that action, but in the legacy
format, even though the behavior is the same (the queue is only on one action),
it reads as if the queue could/should apply to multiple actions.
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
