Hi,
I am using rsyslog 7.0.2 with the configuration below ...
$WorkDirectory /var/spool/rsyslog # default location for work (spool) files
$ActionQueueType Linkedlist # use asynchronous processing
$ActionQueueFileName rsyslog # set file name, also enables disk mode
$ActionQueueMaxDiskSpace 1g # set queue disk space
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
I just would like to understand the queue process for the conditions below, the
volume of messages for the last two conditions is greater than for the first
one.
if ($programname startswith 'LOG_N21' or $programname startswith
'LOG_N22') then :omrelp:IP:PORT if ($msg startswith 'KEY_ABC') then
:omrelp:IP:PORT;template_abc if ($msg startswith 'KEY_DEF') then
:omrelp:IP:PORT;template_def
However, when I look at the queued messages, I only have entries that match the
first condition. What's the reason? -rw------- 1 root root 1049215 Nov 23 07:55
rsyslog.00000005-rw------- 1 root root 1049437 Nov 23 08:00
rsyslog.00000006-rw------- 1 root root 1049204 Nov 23 08:37 rsyslog.00000007
Regards, Flavio
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
