[rsyslog] local/remote logging

[Johnny Tan]

Rainer Gerhards wrote:
> Hi Johnn,
> 
> On Wed, 2008-03-05 at 19:49 -0500, Johnny Tan wrote:
>> I want to have logs written locally (the way they usually 
>> are) as well as sent to a central logger.
>>
>> The two situations that I want local logs for are:
>>
>> 1) in case the central logger is not available for any 
>> reason, I don't lose messages
> 
> You don't need to lose message when the remote host is unavailable. Use
> queued mode. This is currently documented for the database, but works
> for any other action as well:

Hmm... and this is doable even with 2.x, right?

So I could have it queued in memory buffer long enough to 
bring it back up or bring up another one with same ip to 
accept the messages?



>> Assuming yes, I already got the remote logging working. What 
>> do I do to get the simultaneous local logging to work too?
> 
> Rsyslog carries out whatever you configure. So just add a rule for local
> logging, e.g.
> 
> *.* -/var/log/local-logfile

Awesome! Thanks.

I'll post on the wiki once I get it working.

johnn