FYI: the attachment didn't make it to the list due to size, but I got it. Will have a look, but probably tomorrow.
Rainer El mié., 9 ene. 2019 a las 16:37, noalex (<[email protected]>) escribió: > You can find attached the debug logs (it's quite a lot so hope that what's > you are looking for). > > For this test, I have: > - Specify the configuration as such with 192.168.56.103 being not > reachable: > action(type="omfwd" > queue.filename="fwdRule1" > queue.size="500" > queue.highwatermark="400" > queue.lowwatermark="100" > queue.maxdiskspace="1m" > queue.saveonshutdown="on" > queue.type="LinkedList" > action.resumeRetryCount="-1" > Target="192.168.56.103" > Port="1514" > Protocol="tcp") > > - I executed a script which will execute this entry X times "logger "PLOP > Testmessage #$i"". > - From around the message 2886 (Jan 9 16:21:34 rsyslog-server alex: PLOP > Testmessage #2886), so when the maxdiskspace is about 1m, rsyslog stopped > writing to disk even for the first actions and not just the forwarding one > as it should do. > > > > > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Wednesday, 9 January 2019 16:08, Rainer Gerhards < > [email protected]> wrote: > > > El mié., 9 ene. 2019 a las 15:34, noalex (<[email protected]>) escribió: > >> Thanks for the reply. >> >> It's still the same issue with version 8.40.0 :/ >> >> > That's really strange. Can you create a debug log? From startup until at > least one failing message? > > https://www.rsyslog.com/doc/v8-stable/troubleshooting/howtodebug.html > > Rainer > >> >> Alex >> >> >> >> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ >> On Wednesday, 9 January 2019 09:14, Rainer Gerhards < >> [email protected]> wrote: >> >> This looks correct. So I guess what you see is a bug in that old version. >> I suggest to update to rsyslog current, which is 8.40.0 right now. >> >> Rainer >> >> El mar., 8 ene. 2019 a las 23:04, noalex via rsyslog (< >> [email protected]>) escribió: >> >>> Hi, >>> >>> I'm trying to set up a Rsyslog client which will store the log locally >>> as well as forwarding them to a Rsyslog Collector. >>> >>> To give you an overview, below is what I have so far: >>> >>> #### GLOBAL DIRECTIVES #### >>> # Where to place auxiliary files >>> global(workDirectory="/var/lib/rsyslog") >>> >>> # Use default timestamp format >>> module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat") >>> >>> # Include all config files in /etc/rsyslog.d/ >>> $IncludeConfig /etc/rsyslog.d/*.conf >>> >>> #### MODULES #### >>> module(load="imuxsock") >>> module(load="imjournal" StateFile="imjournal.state") >>> >>> #### RULES #### >>> *.info;mail.none;authpriv.none;cron.none /var/log/messages >>> authpriv.* /var/log/secure >>> mail.* -/var/log/maillog >>> cron.* /var/log/cron >>> *.emerg :omusrmsg:* >>> uucp,news.crit /var/log/spooler >>> local7.* /var/log/boot.log >>> >>> # ### Forwarding rule ### >>> action(type="omfwd" >>> queue.filename="fwdRule1" >>> queue.size="10000" >>> queue.highwatermark="9600" >>> queue.lowwatermark="100" >>> queue.maxdiskspace="100m" >>> queue.saveonshutdown="on" >>> queue.type="LinkedList" >>> action.resumeRetryCount="-1" >>> Target="192.168.1.25" >>> Port="514" >>> Protocol="tcp") >>> >>> What I would like to do is: >>> - Store all the logs locally following the above rules - I don't need a >>> queue here but I need them to be store locally in case I need them >>> - Forward all the logs to the remote Rsyslog server. If the there is >>> connection failure between rsyslog client and server, store in memory with >>> a threshold of 9600 messages and then store on disk until the disk storage >>> reach 100mo. After that drop the messages (for the last action). >>> - When the connection is up again, forward the log to the Rsyslog Server >>> if it didn't reach the threshold. >>> >>> However, it's like the first rules (used to store locally) take the >>> queue parameters used by the forwarding action. When the disk space is >>> 100mo, they stop storing locally and store in memory ... I cannot make it >>> work and be comfortable about the behaviour of Rsyslog. >>> >>> Could you please advise what I am doing wrong or if I misunderstood >>> anything? >>> >>> System Used: Centos >>> Rsyslog version: 8.24.0 >>> >>> Cheers >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >> >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
