1

I am using rsyslog to read the logs from an input file (using imfile module) and to send the logs to a remote server using RELP (module omrelp). I am using an action queue for this. It is a disk-assisted queue. The rsyslog is running as a background process and as recommended in the docs, I am not running the rsyslog in debug mode. I want to get a debug message on client side whenever rsyslog is dropping messages (in scenarios where remote server is not reachable for long duration). Is there any way I can do this without enabling the debug logs by default? Can rsyslog send an extra message to the server (maybe appended in the logs) whenever server comes back up ? This would notify the server that some messages were dropped. Here is my rsyslog conf:

module(load="omrelp")
module(load="imfile")

global(workDirectory="/tmp/rsyslog")

input(type="imfile"
File="/srv/myapp/logs/test.log"
Tag="test-"
Ruleset="sendToLogserver"
addMetadata="on")

ruleset(name="sendToLogserver") {
action(type="omrelp"
Target=<server-IP> Port=<>

queue.type="LinkedList"
queue.size="10000"
queue.filename="q_sendToLogserver"
queue.highwatermark="9000"
queue.lowwatermark="50"
queue.maxdiskspace="1g"
queue.saveonshutdown="on"

action.resumeRetryCount="-1"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
action.resumeInterval="10")
}
0

This can be achieved with the help of impstats module in rsyslog. This module provides periodic output of rsyslog internal counters.

It displays messages periodically about different queues and actions. The period is configurable. The stats emitted by impstats are just like other normal messages.

I don't need to explain more as You can get all the info here,

http://www.rsyslog.com/doc/v8-stable/configuration/modules/impstats.html

Here is an article from rsyslog owner on how to use it,

http://www.rsyslog.com/how-to-use-impstats/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.