[rsyslog] actionqueue in front of tcp forward

Johnny Tan linuxweb at gmail.com
Wed Mar 12 18:16:56 CET 2008


I wanted to setup my rsyslog clients such that when the 
rsyslog server is down and then comes back up, the clients 
will resume forwarding messages to it.

I'm running into this same bug as another user:
http://bugzilla.adiscon.com/show_bug.cgi?id=45

According to that bug, the fix is in 3.12.1, which is what 
I'm using on client and server.


But I still can't seem to get it to work. Prior to doing 
this, I simply had this line:

*.* @@127.0.0.1:61514



Am I supposed to replace that line entirely with the 
ActionQueue stanza, such as this one (the == is for clarity, 
not actually part of my config):

==
$WorkDirectory /tmp/rsyslogwork
$ActionQueueType LinkedList
$ActionQueueFileName dqueue
$ActionQueueSaveOnShutdown on
$ActionQueueDiscardSeverity 7
$ActionResumeInterval 30
$ActionResumeRetryCount -1  # infinite retries on insert failure
&         @@127.0.0.1:61514
==

If I do, rsyslog dies immediately on restart. So I changed 
it so look like this instead:

==
*.* @@127.0.0.1:61514
$WorkDirectory /tmp/rsyslogwork
$ActionQueueType LinkedList
$ActionQueueFileName dqueue
$ActionQueueSaveOnShutdown on
$ActionQueueDiscardSeverity 7
$ActionResumeInterval 10
$ActionResumeRetryCount -1
&         @@127.0.0.1:61514
==

This allows rsyslog to work again, but then it doesn't 
actually do any resume. Just as the OP states in the bug, if 
the rsyslog server is stopped, the client simply logs 
messages locally. When the rsyslog server is started again, 
the client once again logs locally as well as to the server. 
But all the messages from the client between stop and start 
on the server are not forwarded.

I checked action.c and it does have the code-fix listed in 
the forum post tied to the bug.

I also understand that one message WILL be lost, which is a 
TCP syslog protocol problem. So I sent multiple messages, 
none of them came through.

johnn



More information about the rsyslog mailing list