On 19.02.2022 14:11, Mariusz Kruk via rsyslog wrote:
I did a very simple setup
module(load="imudp")
input(type="imudp" port="10514")
$WorkDirectory /tmp/rsyslog1
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
$ActionResumeInterval 1
#*.* -/tmp/log.log
*.* @@127.0.0.1:10514
If I run rsyslogd in debug mode and I don't have anything running on
TCP port to receive forwarded data, I see that messages do indeed get
queued and retried every second.
But if I uncomment local file logging, it's that action that gets
retried in case of failure (I had some pre-existing /tmp/log.log file
with wrong ownership so the action would fail until I removed it) but
the forward is tried only once and forgotten about (at least for some
time; I didn't wait very long for retry but it definitely wasn't
retried as often as $ActionResumeInterval).
So I suppose the clou of the OP's problem is that his config (which
relies on a very old guide - way back from 2008 if I see correctly)
sets the retry parameters for the wrong action.
Maybe it's worth mentioning in that document that it's a bit outdated
and possibly misleading if applied "incorrectly"?
OK. I did some further testing and indeed, duplicating all those $Action
parameters again after the first action results in the forward action
being indeed repeated properly every second.
So the OP's problem was really not that it didn't work but that it
worked only on the first action it encountered in the config.
But it's indeed best to use the new format
action(type="omfwd" action.resumeRetryCount="-1" target="my.server" )
It's much clearer this way.
MK
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
