On Thu, 8 Nov 2018, [email protected] wrote:
Hi David,
rsyslog doesn't change permissions of files that already exist,
I deleted all log files and the *.info works with the correct file permissions.
Thank-you for all your & everybody else's help so far.
Question 1 : The remote servers look like they log into the *.warn file
file="/app/rsyslog/messages.all" except the actual syslog server, which does
not: # logger -t user.kern TEST logs into the *.info file but not the *.warn
/messages.all.
user.kern doesn't mean anything, user and kern are both facilities and it's
supposed to be facility.severity
see https://en.wikipedia.org/wiki/Syslog
Question 2: Is it worth adding disk based queues for the locally logged files
below? e.g
it's almost never worth adding a queue for a local file, let alone a disk based
queue. The process to delivery the log locally is so fast that you probably slow
things down by adding a queue to it.
template(name="dynaName" type="string" string="/app/rsyslog/%hostname%.log")
*.info {
action(
type="omfile"
name="infoActionName"
dynafile="dynaName"
queue.spoolDirectory="/app/rsyslog/queues"
queue.size="1024000"
queue.filename="hostname-info.queue"
queue.maxdiskspace="64m"
queue.type="FixedArray"
queue.maxfilesize="10m"
queue.saveonshutdown="on"
queue.discardseverity="7"
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
)
}
*.warn {
action(
type="omfile"
name="warnActionName"
file="/app/rsyslog/messages.warn.all"
)
}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
