Sorry, the message is garbled. Can you repost? Also note that the action queue parameters only affect the immediately following action. From what I can read out of the posting, you seem to assume it affects all actions, which is not the case. I suggest to use the new style config format, as this makes these things much more explicit and easier to understand.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Flavio Oliveira > Sent: Monday, November 26, 2012 8:42 AM > To: [email protected] > Subject: [rsyslog] Queue > > > Hi, > > I am using rsyslog 7.0.2 with the configuration below ... > > $WorkDirectory /var/spool/rsyslog # default location for work > (spool) files > $ActionQueueType Linkedlist # use asynchronous processing > $ActionQueueFileName rsyslog # set file name, also enables disk > mode > $ActionQueueMaxDiskSpace 1g # set queue disk space > $ActionResumeRetryCount -1 # infinite retries on insert > failure > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog > shuts down > > I just would like to understand the queue process for the conditions > below, the volume of messages for the last two conditions is greater > than for the first one. > > if ($programname startswith 'LOG_N21' or $programname startswith > 'LOG_N22') then :omrelp:IP:PORT if ($msg startswith 'KEY_ABC') then > :omrelp:IP:PORT;template_abc if ($msg startswith 'KEY_DEF') then > :omrelp:IP:PORT;template_def > However, when I look at the queued messages, I only have entries that > match the first condition. What's the reason? -rw------- 1 root root > 1049215 Nov 23 07:55 rsyslog.00000005-rw------- 1 root root 1049437 Nov > 23 08:00 rsyslog.00000006-rw------- 1 root root 1049204 Nov 23 08:37 > rsyslog.00000007 > > Regards, Flavio > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
