[rsyslog-notify] Forum Thread: Re: Postfix reliable setup - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24857#p24857

Message: 
----------
You have run into a common problem with logging.

If you say that you want to always have logs, and you want the application
to stop if the logs can't be written, then when the logs can't be written
because a remote system is down, your application stops :-)

The first-level workaround that you can do is to setup a disk assisted
queue on your postfix machine so that when rsyslog can't send logs to the
remote machine it will write them to disk.

But if the disk partition you are writing to fills up, or some other local
error happens that prevents rsyslog from writing to this disk queue, your
application will still stop.

Another thing you can do is to make your rsyslog server highly available so
that when one machine goes down, the traffic will be handled by a second
machine. Usually the default memory queue will handle the logs long enough
to fail over without interrupting your service.

There are also configuration options in rsyslog to tell it that when it's
queues are filling up, start throwing away lower priority logs while
continuing to buffer the higher priority logs.

Eventually you need to decide which is more important, the application
running or writing it's logs?

For most people, keeping the system running is more important :-)


What I suggest as the typical architecture is to setup a pair of systems as
a HA failover set to receive your logs on your local network, and then use
UDP to send from all your local machines to this pair. Over a local network
(where you don't have routers or bandwidth bottlenecks to cause packets to
be dropped), UDP is very reliable (as long as your receivers can keep up,
which properly configured rsyslog should have no trouble with), and accept
that a small number of logs could be lost as the pair fails over.