what I would do is
ruleset(name="forwarding"
queue.type = "LinkedList"
queue.filename = "queue_pelslog2.trioptima.net"
action.resumeRetryCount = "-1"
queue.saveonshutdown = "on"
queue.maxdiskspace = "5g")
{
action(
port = "20515"
target = "log server a"
type = "omrelp"
template = "RSYSLOG_ForwardFormat"
)
action(
port = "20515"
target = "log server b"
type = "omrelp"
template = "RSYSLOG_ForwardFormat"
action.execOnlyWhenPreviousIsSuspended = "on"
)
}
so that the queue is separate from the two actions
I suspect that the omrelp module is keeping some messages in it's memory before
it suspends, but I'd need Rainer to comment on that and what can be done there.
David Lang
On Wed, 4 Sep 2019, Patrik Martinsson via rsyslog wrote:
Date: Wed, 4 Sep 2019 14:47:34 +0000
From: Patrik Martinsson via rsyslog <[email protected]>
To: "[email protected]" <[email protected]>
Cc: Patrik Martinsson <[email protected]>
Subject: [rsyslog] Making sure I understand execOnlyWhenPreviousIsSuspended
correctly,
Hi,
I'm sure this question has been answered multiple times, I do however just want
to confirm/make sure I'm not misunderstanding anything. I actually can't find
the exact documentation for this.
We recently configured two rsyslog-servers (aka. central log servers), they use
the same shared storage.
Each client is configured to send messages to log server A, and if that fails,
it should send to log server B.
If log server B also is unavailable, client will "cache its logs" according to
its queue configuration.
Log server B is configured with a different template for its actions when
receiving logs, thus avoiding writing to the same file on the shared filesystem.
That works well, and as intended. With the following caveat,
If a client send logs (while true ; do echo $(date) | logger -t foo && sleep 1;
done) to log server A, and I stop rsyslog on log server A, it will take about a minute
or two before logserver B starts writing logs to disk.
Those messages that are generated during that minute/two minutes, are now in
the client's memory only. They do not show up in the logfile when logserver B
starts writing.
If I now start rsyslog on log server A, those messages (the ones in the memory
of the client), are now being written down to disk by logserver A.
So that means, if I manually take down logserver A, and a client stops
rsyslog/crashes or similar, its messages (that were written 'while the
failover/detection of failover') will be discarded.
Is that correctly understood based on the following client configuration,
action(
port = "20515"
target = "log server a"
type = "omrelp"
template = "RSYSLOG_ForwardFormat"
)
action(
queue.type = "LinkedList"
queue.filename = "queue_pelslog2.trioptima.net"
action.resumeRetryCount = "-1"
queue.saveonshutdown = "on"
queue.maxdiskspace = "5g"
port = "20515"
target = "log server b"
type = "omrelp"
template = "RSYSLOG_ForwardFormat"
action.execOnlyWhenPreviousIsSuspended = "on"
)
And if so, is there a better way of doing it ? Or is the only way to not end up
in a scenario like this to always send my logs to multiple log servers ?
With the risk of misunderstanding something, I just don't understand why "the
logs that are being generated during the failover cant be flushed to action 2 - why
are they only getting written when log server A gets available again).
If I set action 1 to be a queue of linkedlist, action 2 never seems to get triggered. As I
understand it, only "direct queues" can be used to trigger
"execOnlyWhenPreviousIsSuspended", is that correct ?
Or. at least in the scenario above, direct queue is the only option, because
setting action 1 to linkedlist will not make it fail just because the target
gets unavailable, since it will write the message to the queue, right ?
Hope I didn't make it to confusing.
Best regards,
Patrik Martinsson - Linux System Administrator Mäster Samuelsgatan 17, 111 44
Stockholm, Sweden E [email protected]
W www.trioptima.com
YT Genuine Happiness !
Please see the disclaimer: www.trioptima.com/email
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
