That makes sense!
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Flavio Oliveira > Sent: Monday, November 26, 2012 9:03 AM > To: [email protected] > Subject: Re: [rsyslog] Queue > > > Rainer, > > Thank you for the explanation. I looked at the link below, so I guess I > should update my configuration > > http://www.rsyslog.com/actions-with-directives/ > > It should be like: > > #first action > > $ActionQueueType LinkedList # use asynchronous processing > > $ActionQueueFileName srvrfwd # set file name, also enables disk mode > > $ActionResumeRetryCount -1 # infinite retries on insert failure > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts > down > if ($programname startswith 'LOG_N21' or $programname startswith > 'LOG_N22') then :omrelp:IP:PORT > > > > #second action > > $ActionQueueType LinkedList # use asynchronous processing > > $ActionQueueFileName srvrfwd # set file name, also enables disk mode > > $ActionResumeRetryCount -1 # infinite retries on insert failure > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts > down > if ($msg startswith 'KEY_ABC') then :omrelp:IP:PORT;template_abc > #third action > > $ActionQueueType LinkedList # use asynchronous processing > > $ActionQueueFileName srvrfwd # set file name, also enables disk mode > > $ActionResumeRetryCount -1 # infinite retries on insert failure > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts > down > if ($msg startswith 'KEY_DEF') then :omrelp:IP:PORT;template_def > > Regards, Flavio > > > From: [email protected] > > To: [email protected] > > Date: Mon, 26 Nov 2012 07:48:42 +0000 > > Subject: Re: [rsyslog] Queue > > > > Sorry, the message is garbled. Can you repost? > > > > Also note that the action queue parameters only affect the > immediately following action. From what I can read out of the posting, > you seem to assume it affects all actions, which is not the case. I > suggest to use the new style config format, as this makes these things > much more explicit and easier to understand. > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Flavio Oliveira > > > Sent: Monday, November 26, 2012 8:42 AM > > > To: [email protected] > > > Subject: [rsyslog] Queue > > > > > > > > > Hi, > > > > > > I am using rsyslog 7.0.2 with the configuration below ... > > > > > > $WorkDirectory /var/spool/rsyslog # default location for work > > > (spool) files > > > $ActionQueueType Linkedlist # use asynchronous processing > > > $ActionQueueFileName rsyslog # set file name, also enables > disk > > > mode > > > $ActionQueueMaxDiskSpace 1g # set queue disk space > > > $ActionResumeRetryCount -1 # infinite retries on insert > > > failure > > > $ActionQueueSaveOnShutdown on # save in-memory data if > rsyslog > > > shuts down > > > > > > I just would like to understand the queue process for the > conditions > > > below, the volume of messages for the last two conditions is > greater > > > than for the first one. > > > > > > if ($programname startswith 'LOG_N21' or $programname > startswith > > > 'LOG_N22') then :omrelp:IP:PORT if ($msg startswith 'KEY_ABC') > then > > > :omrelp:IP:PORT;template_abc if ($msg startswith 'KEY_DEF') > then > > > :omrelp:IP:PORT;template_def > > > However, when I look at the queued messages, I only have entries > that > > > match the first condition. What's the reason? -rw------- 1 root > root > > > 1049215 Nov 23 07:55 rsyslog.00000005-rw------- 1 root root 1049437 > Nov > > > 23 08:00 rsyslog.00000006-rw------- 1 root root 1049204 Nov 23 > 08:37 > > > rsyslog.00000007 > > > > > > Regards, Flavio > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > > > if you DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
