On Sat, 19 Feb 2022, Mariusz Kruk via rsyslog wrote:
OK, let me get this straight because the legacy format is confusing at times
:-)
If I do
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.* /tmp/whatever.log
*.* @@some.host:port
The queue parameters will get applied only to the first action? (in this case
- to file write)?
In order to apply them to the next action I'd have to repeat the
$ActionWhatever statements?
mostly, not always.
queue items only apply to the next action, I dont' remember if retryCount
applies only to the next action or to all actions until it's set to something
else.
there is a reason why most of the $foo settings are discouraged. If you can do
something in one line with the old format, it can make sense to do it. but if
you have to do several $foo lines and then your action, you probably should
switch to the action() format to make it explicitly clear what you are doing.
David Lang
MK
On 19.02.2022 00:21, David Lang via rsyslog wrote:
right, but the following doesn't setup buffering on the implied ruleset, it
sets it up on the first action in the first file found
/etc/rsyslog.d/*.conf
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
yes, setting up an action on the ruleset works, but I don't think that's
supported in the legacy format at all
David Lang
On Fri, 18 Feb 2022, Mariusz Kruk via rsyslog wrote:
My bad. I meant that both actions are within the same main implied ruleset
as far as I understand the legacy format.
Anyway, just to be on the safe side, I'd do a separate "output" ruleset
with its own queue and within that ruleset I'd do the output action.
That does work. I have several dozens hosts working like that.
On 18 February 2022 22:51:54 CET, David Lang <[email protected]> wrote:
On Fri, 18 Feb 2022, Mariusz Kruk via rsyslog wrote:
I'm not fully sure, however, since you use the legacy config format
what's
the interaction between both actions within the same queue. In order to
be
sure to have proper queueing _on the forwarding action_ I'd do a
separate
queue for this omfwd (or omrelp or whatever you're gonna use in the end)
action alone.
you can't have one queue for multiple actions, you can have a queue on a
ruleset
that contains multiple actions, but a queue on one action is only on that
one
action.
This is one of the reasons that the legacy format is discouraged for this
sort
of thing. In the new format where the queue is part of the action()
statement,
it is very clear that the queue is only on that action, but in the legacy
format, even though the behavior is the same (the queue is only on one
action),
it reads as if the queue could/should apply to multiple actions.
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
