Rainer, Thank you for the explanation. I looked at the link below, so I guess I should update my configuration
http://www.rsyslog.com/actions-with-directives/ It should be like: #first action $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName srvrfwd # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down if ($programname startswith 'LOG_N21' or $programname startswith 'LOG_N22') then :omrelp:IP:PORT #second action $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName srvrfwd # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down if ($msg startswith 'KEY_ABC') then :omrelp:IP:PORT;template_abc #third action $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName srvrfwd # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down if ($msg startswith 'KEY_DEF') then :omrelp:IP:PORT;template_def Regards, Flavio > From: [email protected] > To: [email protected] > Date: Mon, 26 Nov 2012 07:48:42 +0000 > Subject: Re: [rsyslog] Queue > > Sorry, the message is garbled. Can you repost? > > Also note that the action queue parameters only affect the immediately > following action. From what I can read out of the posting, you seem to assume > it affects all actions, which is not the case. I suggest to use the new style > config format, as this makes these things much more explicit and easier to > understand. > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Flavio Oliveira > > Sent: Monday, November 26, 2012 8:42 AM > > To: [email protected] > > Subject: [rsyslog] Queue > > > > > > Hi, > > > > I am using rsyslog 7.0.2 with the configuration below ... > > > > $WorkDirectory /var/spool/rsyslog # default location for work > > (spool) files > > $ActionQueueType Linkedlist # use asynchronous processing > > $ActionQueueFileName rsyslog # set file name, also enables disk > > mode > > $ActionQueueMaxDiskSpace 1g # set queue disk space > > $ActionResumeRetryCount -1 # infinite retries on insert > > failure > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog > > shuts down > > > > I just would like to understand the queue process for the conditions > > below, the volume of messages for the last two conditions is greater > > than for the first one. > > > > if ($programname startswith 'LOG_N21' or $programname startswith > > 'LOG_N22') then :omrelp:IP:PORT if ($msg startswith 'KEY_ABC') then > > :omrelp:IP:PORT;template_abc if ($msg startswith 'KEY_DEF') then > > :omrelp:IP:PORT;template_def > > However, when I look at the queued messages, I only have entries that > > match the first condition. What's the reason? -rw------- 1 root root > > 1049215 Nov 23 07:55 rsyslog.00000005-rw------- 1 root root 1049437 Nov > > 23 08:00 rsyslog.00000006-rw------- 1 root root 1049204 Nov 23 08:37 > > rsyslog.00000007 > > > > Regards, Flavio > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > > if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
