[rsyslog-notify] Forum Thread: Re: Time lag issue of forwarding vs available I/O at 6600 mp - (Mode 'reply')

[noreply at adiscon.com]

User: rajatg 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26798#p26798

Message: 
----------
Hi David,

While going on with the imfile approach, I found out that the issue was
because I was truncating the log file which I was monitoring (<!-- l --><a
class="postlink-local"
href="http://kb.monitorware.com/rsyslog-imfile-module-breaks-when-files-are-truncated-t10891.html">rsyslog-imfile-module-breaks-when-files-are-truncated-t10891.html</a><!--
l -->). So, as soon as I was thinking that imfile is a full go. I tried to
test the keepalive mode of central server and I found out that at the time
of switching (between the master to back up server) all the messages are
lost for a certain window. Can you please help in solving this last glitch?

Server config now looks like-:
[code:3swn7f7o]
module(
  load="impstats"
  interval="10"             # how often to generate stats
  resetCounters="on"        # to get deltas (e.g. # of messages
submitted in the last 10 seconds)
  log.file="/tmp/stats"     # file to write those stats to
  log.syslog="off"          # don't send stats through the normal
processing pipeline. More on that in a bit
)

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by
rklogd)
#$ModLoad immark  # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerKeepAlive on
$InputTCPServerRun 514
#module(load="imptcp" KeepAlive="on")
#input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
$EscapeControlCharactersOnReceive off
$AllowedSender TCP, 10.140.214.199, 10.140.214.196,
10.140.214.197, 10.140.214.198,
10.140.214.200

if $msg contains "DSS API LOGGING" then /var/log/api.log
#*.* /var/log/api.log
$template FILENAME,"/var/log/main_syslog.log"
*.* ?FILENAME
#:msg, contains, "irq" then /var/log/filtered_rsyslog.log
:msg, contains, "irq" stop
:msg, contains, "COMMAND=/bin/grep" stop
*.* /var/log/filtered_rsyslog.log

[/code:3swn7f7o]