[rsyslog] Reliability questions about rsyslog and capabilities.
david at lang.hm
david at lang.hm
Wed Sep 15 19:53:45 CEST 2010
On Wed, 15 Sep 2010, Sivan Greenberg wrote:
> Hi List,
> I am wondering if there's a possibility to execute a shell command
> based on a msg received in rsyslog. If so, is there an option to
> execute the command with the content of the msg or with parts of it
> for that matter?
> Relating to availability, I'm also keen to know what happens when:
> - It tries to start when there's no network interface available to bind to?
by default, rsyslog will bind to IPANY, not to a particular IP address, if
you leave it like this rsyslog will start and then when the network comes
up the traffic will get to rsyslog.
> - If the hostname on which rsyslog is reporting from/to changes
> between reboots but not necessarily?
I don't think rsyslog will care
> - What happens if text log files consume entire free space on the
> machine where rsyslog runs?
rsyslog will stop writing to disk, receiving messages into it's memory
queue (by default) until it hits the configured limit, then it will stop
accepting new messages (which will mean dropping UDP messages or stalling
> Also, I'm interested to know if in subsecond resolution there can
> occur a false duplicate msg reduction ? Or if it can occur on any
> other grounds? Does RSYSLOG_ForwardFormat solve this?
duplicate message supression is an optional feature, it just looks at the
message itself, not at the timestamp
> And last, but not least :) Can I send rsyslog'd debugging or
> error/warning logs to somewhere different like /tmp/rsyslog.log for
> easy troubleshooting of /var/log becomes inaccessible for any reason.
you can configure rsyslog to write messages whereever you want to (system
> Many thanks,
> rsyslog mailing list
More information about the rsyslog