i've a problem with rsyslog 5.8.4. i need MARK messages to check if rsyslog is still sending messages to the central logserver. here's the config:
rsyslog.conf: # Loading modules $ModLoad imuxsock $ModLoad imklog $ModLoad immark $MarkMessagePeriod 1200 <local selectors> *.* @@logserver:514;RSYSLOG_ForwardFormat i expect to see a MARK messages if no messages have been forwarded for 20 minutes but there's not a single MARK. after 60 minutes the log analyting engine on the central logserver issues an alert because it didn't see anything the the monitored host. my current workaround is to force rsyslog to send MARK messages: $ActionWriteAllMarkMessages on *.* @@logserver:514;RSYSLOG_ForwardFormat this seems to work. why doesn't rsyslog send MARKs in the first place? $RepeatedMsgReduction is always off. can anybody help? regards, -ap _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
