[rsyslog] local/remote logging

[Rainer Gerhards]

> >> 1) in case the central logger is not available for any 
> >> reason, I don't lose messages
> > 
> > You don't need to lose message when the remote host is 
> unavailable. Use
> > queued mode. This is currently documented for the database, 
> but works
> > for any other action as well:
> 
> Hmm... and this is doable even with 2.x, right?

Sorry, Dude, no such queues in v2 :-(

> So I could have it queued in memory buffer long enough to 
> bring it back up or bring up another one with same ip to 
> accept the messages?

It's *not* a main memory buffer. If you configure it to use disk *and*
you have enough disk space, it can queue for ages. It's pretty advanced,
the full doc on queues is here:

http://www.rsyslog.com/doc-queues.html

The disk, of course, is only touched if needed. If the destination
server is only offline for a brief period, messages may be buffered in
memory only. But if the volume is too large or you stop rsyslogd for a
while, it is written disk.

So if you have enough disk space and your destination dies on Friday and
you are too lazy to come in over the weekend, rsyslogd will send all
queued elements after the restart on Monday. The same, of course, works
if you are on vacation ;)

Rainer