1

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues.

I was able to send logs to the forwarding servers using the following configurations.

   action(type="omfwd" target="host1" port="10515" protocol="udp" )
   action(type="omfwd" target="host2" port="10514" protocol="udp" )

Now, I want to keep the logs in queues so that whenever my target server goes down, I won’t lose the logs.

To do that, I’m doing something like this:

action(type="omfwd" target="host1" port="10515" protocol="udp"
               queue.spoolDirectory="/var/lib/rsyslog"
               queue.type="LinkedList"
               queue.filename="host1.queue"
               action.resumeRetryCount="-1"
               queue.saveOnShutdown="on"
)

action(type="omfwd" target="host2" port="10514" protocol="udp"
           queue.type="LinkedList"
           queue.filename="host2.queue"
           action.resumeRetryCount="-1"
           queue.saveOnShutdown="on"
)

If I shut down the forwarding server, the logs are not created in queue file which I’m expecting to be present at /var/lib/rsyslog as I have this setting:

global(
    net.enableDNS="off"
    preserveFQDN="on"
    umask="0004"
    workDirectory="/var/lib/rsyslog"
)

JFTR,

  • configuration doesn’t have any configuration errors.
  • I have enabled debugging in rsyslogd, but that didn’t point me any errors.
0

I managed to figure out reason for this behaviour:

Quoting from here

actual spool files are only created if the remote server is down and there is no more space in the in-memory queue. By default, a short failure of the remote server will never result in the creation of a disk file as a couple of hundred messages can be held in memory by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.