[rsyslog] actionqueue in front of tcp forward

[Rainer Gerhards]

I need to check for the restart problem (currently working on something
else). Please also follow this bug:

http://bugzilla.adiscon.com/show_bug.cgi?id=48

This is the "one message lost" problem, and I have created at least some
cure for it today (to be verified). Will check your bug report when I
verify it.

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Johnny Tan
> Sent: Wednesday, March 12, 2008 6:17 PM
> To: rsyslog-users
> Subject: [rsyslog] actionqueue in front of tcp forward
> 
> I wanted to setup my rsyslog clients such that when the
> rsyslog server is down and then comes back up, the clients
> will resume forwarding messages to it.
> 
> I'm running into this same bug as another user:
> http://bugzilla.adiscon.com/show_bug.cgi?id=45
> 
> According to that bug, the fix is in 3.12.1, which is what
> I'm using on client and server.
> 
> 
> But I still can't seem to get it to work. Prior to doing
> this, I simply had this line:
> 
> *.* @@127.0.0.1:61514
> 
> 
> 
> Am I supposed to replace that line entirely with the
> ActionQueue stanza, such as this one (the == is for clarity,
> not actually part of my config):
> 
> ==
> $WorkDirectory /tmp/rsyslogwork
> $ActionQueueType LinkedList
> $ActionQueueFileName dqueue
> $ActionQueueSaveOnShutdown on
> $ActionQueueDiscardSeverity 7
> $ActionResumeInterval 30
> $ActionResumeRetryCount -1  # infinite retries on insert failure
> &         @@127.0.0.1:61514
> ==
> 
> If I do, rsyslog dies immediately on restart. So I changed
> it so look like this instead:
> 
> ==
> *.* @@127.0.0.1:61514
> $WorkDirectory /tmp/rsyslogwork
> $ActionQueueType LinkedList
> $ActionQueueFileName dqueue
> $ActionQueueSaveOnShutdown on
> $ActionQueueDiscardSeverity 7
> $ActionResumeInterval 10
> $ActionResumeRetryCount -1
> &         @@127.0.0.1:61514
> ==
> 
> This allows rsyslog to work again, but then it doesn't
> actually do any resume. Just as the OP states in the bug, if
> the rsyslog server is stopped, the client simply logs
> messages locally. When the rsyslog server is started again,
> the client once again logs locally as well as to the server.
> But all the messages from the client between stop and start
> on the server are not forwarded.
> 
> I checked action.c and it does have the code-fix listed in
> the forum post tied to the bug.
> 
> I also understand that one message WILL be lost, which is a
> TCP syslog protocol problem. So I sent multiple messages,
> none of them came through.
> 
> johnn
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog