[rsyslog-notify] Forum Thread: Re: Getting omudpspoof for 5.8.6 on Ubuntu LTS - (Mode 'reply')

[noreply at adiscon.com]

User: treesloth 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24869#p24869

Message: 
----------
[quote="dlang":39btz63k]it's probably in the base package if it's there at
all, but when you are doing complex things (and udpspoof is complex and
seriously hurts performance), you _really_ want to be on a newer version.
The community supported version is 8.x, so you really should upgrade to it.

see <!-- m --><a class="postlink"
href="http://www.rsyslog.com/doc/omudpspoof.html">http://www.rsyslog.com/doc/omudpspoof.html</a><!--
m -->

Try just using it.

udpspoof should only be needed to work around broken systems, what system
are you trying to send logs to that's broken?[/quote:39btz63k]

We're not trying to work around a broken system.  I didn't see anything in
the documentation to suggest that it's only a workaround for broken
systems, and for our purposes it seemed like a good fit.  We have a server
that's accessible to a number of production servers, but which is no longer
sufficient to store the volume of logs it's receiving.  We have another
with plenty of storage which can't be accessed by the production server. 
It would be extremely simple if the older rsyslog server could just forward
the logs straight to the new one, preserving the originating IP address. 
We could just carry the old config to the new server, and we have a working
system.  Easy, in theory.  But, we saw no documentation of being intended
as a workaround or of poor performance.  Any idea where we might read about
that?