were there really _no_ messages of any sort during those 20 mintues? not
even a debug level message from CRON when it runs?
remember that MARK will only fire if there are no messages at all.
David Lang
On Tue, 30 Aug 2011, Andreas Piesk wrote:
i've a problem with rsyslog 5.8.4. i need MARK messages to check if rsyslog is
still sending
messages to the central logserver. here's the config:
rsyslog.conf:
# Loading modules
$ModLoad imuxsock
$ModLoad imklog
$ModLoad immark
$MarkMessagePeriod 1200
<local selectors>
*.* @@logserver:514;RSYSLOG_ForwardFormat
i expect to see a MARK messages if no messages have been forwarded for 20
minutes but there's not a
single MARK. after 60 minutes the log analyting engine on the central logserver
issues an alert
because it didn't see anything the the monitored host. my current workaround is
to force rsyslog to
send MARK messages:
$ActionWriteAllMarkMessages on
*.* @@logserver:514;RSYSLOG_ForwardFormat
this seems to work. why doesn't rsyslog send MARKs in the first place?
$RepeatedMsgReduction is
always off. can anybody help?
regards,
-ap
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
