Hi, today I stumbled over a strange problem: When forwarding logs via tcp to a remote logserver, and the logserver is unreachable, local logging is delayed up to an half hour. Config:
$ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 *.* @@remote-loghost-ip:10514 $ActionExecOnlyWhenPreviousIsSuspended on & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off auth,authpriv.* /var/log/auth.log [... standard local log rules snipped ...] I tested with both 4.6.4-1~bpo50+1 and 3.18.6-4, which are the versions easily available on debian lenny (+backport). Yours Karsten _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
