1

I’m using rsyslog 8.40 and I’m trying to setup logforwarding with queues.

I was able to send logs to the forwarding servers using the following configurations.

   action(type="omfwd" target="host1" port="10515" protocol="udp" )
   action(type="omfwd" target="host2" port="10514" protocol="udp" )

Now, I want to keep the logs in queues so that whenever my target server goes down, I won’t lose the logs.

To do that, I’m doing something like this:

action(type="omfwd" target="host1" port="10515" protocol="udp"
               queue.spoolDirectory="/var/lib/rsyslog"
               queue.type="LinkedList"
               queue.filename="host1.queue"
               action.resumeRetryCount="-1"
               queue.saveOnShutdown="on"
)

action(type="omfwd" target="host2" port="10514" protocol="udp"
           queue.type="LinkedList"
           queue.filename="host2.queue"
           action.resumeRetryCount="-1"
           queue.saveOnShutdown="on"
)

If I shut down the forwarding server, the logs are not created in queue file which I’m expecting to be present at /var/lib/rsyslog as I have this setting:

global(
    net.enableDNS="off"
    preserveFQDN="on"
    umask="0004"
    workDirectory="/var/lib/rsyslog"
)

JFTR,

  • configuration doesn’t have any configuration errors.
  • I have enabled debugging in rsyslogd, but that didn’t point me any errors.

1 Answer 1

0

I managed to figure out reason for this behaviour:

Quoting from here

actual spool files are only created if the remote server is down and there is no more space in the in-memory queue. By default, a short failure of the remote server will never result in the creation of a disk file as a couple of hundred messages can be held in memory by default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .