[rsyslog] Disk error when using rsyslog

[Patrick Shen]

Hi HKS,

Thanks for your good advice. It's helpful.

Patrick

(private) HKS wrote:
> On Fri, Dec 12, 2008 at 1:48 AM, Patrick Shen <patrick.shen at net-m.de> wrote:
>> Hi Rainer,
>>
>> We're using rsyslog(3.20.0) as our central logging server and clients.
>>
>> We experienced an DISK ERROR on server last month. At that time, we were
>> using TCP to transport logs from client to server. And we also setup the
>> configuration just like [1]. But unfortunately our central logging
>> server got DISK error for one hour. So we lost logfiles of that period
>> of time.
>>
>> I've a look at doc [1] carefully, I guess "RELIABLE" only means when
>> server got offline or rsyslogd on it isn't running, then clients will
>> save logs in buffer or write to a file on disk. If server is still
>> online and rsyslogd is running, but with IO/Error or Disk Full, then
>> client will still transfer logs to server even with RELP, coz I guess
>> RELP only protects logs could be transferred via network successfully,
>> it doesn't care the logs are written successfully to file on server. Am
>> I right?
> 
> Yes. RELP Is a protocol for the reliable exchange of event logs over a
> network. What the destination daemon does once it has the logs is no
> concern of the client's.
> 
> 
>> So I guess if we need to prevent this, we need do some work on server?
>> Do we have some "directives" options that we could transfer logs to a
>> failover server if local disk fails or buffer in memory before disk got
>> corrected?
> 
> Yes: http://wiki.rsyslog.com/index.php/FailoverSyslogServer
> 
> -HKS
> 
>> [1]: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html
>>
>> Thanks,
>>
>> --
>> Patrick Shen
>> Operations Engineer
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com