2016-05-26 19:11 GMT+02:00 David Lang <[email protected]>: > On Thu, 26 May 2016, Karri Vrkreddy wrote: > >> Thanks David Lang for looking into this. >> >> Please correct me if I understood your suggestion incorrectly. >> >> I have changed earlier configuration to >> >> *********** >> module(load="imudp") >> ruleset(name="central" >> queue.type="LinkedList" >> queue.size="60000" >> queue.discardmark="55000" >> queue.discardseverity="3"){ >> >> >> action(name="dnsrr" >> type="omfwd" >> Target="denser" >> Port="5544" >> Protocol="tcp" >> template="RSYSLOG_SyslogProtocol23Format") >> action(name="failover" >> type="omfwd" >> Target="fallback" >> Port="5544" >> Protocol="tcp" >> action.execOnlyWhenPreviousIsSuspended="on" >> template="RSYSLOG_SyslogProtocol23Format") >> } >> >> input(type="imudp" >> port="514" >> ruleset="central")**************** >> >> >> Even with the above configuration failover is not working. > > > Ok, someone else will need to comment on this. > > Are you sure the first action is actually failing? With TCP you can stuff > data into the OS buffers after the destination is unreachable for some > timeframe until the OS decides the connection has failed. Rsyslog will then > try to reestablish the connection and only when that fails will it suspend > the action.
A debug log usually helps with troubleshooting such issues. See http://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html for details. > > >> On a related note, How to achieve what you have suggested with legacy >> format ? >> Any pointers are hugely appreciated. > > > I'm not sure it's even possible with the legacy format. Trying to define > rulesets at all in the legacy format was really messsy. I don't know if > defining all the queue things just before the ruleset would end up applying > the queue to the ruleset or the first action in the ruleset. > It is possible (99% sure), but I don't remember how it was done. But as David said, it's an extremely bad idea to change back to old style if new is available. If you absolutely want to do it, please do so only after we found a solution to your problem. Then, check the doc for your old version, I remember there are article on how to do that. Rainer > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
