[rsyslog-notify] Forum Thread: Re: fwd local msg, two listeners to remote server w/TLS, Que - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26630#p26630

Message: 
----------
[quote="atticus":19zd9jpr]Just to clarify a few subtleties here.  Thanks
for pointing these out.  So, here's what I did (or am doing since your
advice)

1)  My FWD1 has a linked list queue in, but it's part of the "ACTION"
statement, not the ruleset.  Is there a subtlety
here of putting the queue parameters 1st in the ruleset beginning before
the action, or after the ACTION as I have it now? or is my syntax
incorrect?[/quote:19zd9jpr]

when a new message is handled by an input, it puts that message in a queue.
This is either the main queue or the ruleset queue if one is defined.

Then a worker thread runs against this queue and processes messages
(including moving them to an action queue if needed)

so with your current config, messages from all sources mix in the main
queue and then are split into the different rulesets for processing. If the
local disk fills up or has an error that prevents writing local messages,
the main queue will fill up and processing will stop for everything. If you
had a separate queue on the ruleset you tie to specific inputs, then
processing for those would continue.

This is a subtle thing.


[quote="atticus":19zd9jpr]
3)  Finally, for the forwarding of the local syslog, I think I will call
FWD1 from FWD2.  It sounds like I could call it just once but will that 
apply to every action in FWD2?  otherwise, I'll have to use the conditional
call.    Also do both approaches use the queue that's already defined for
FW1?
[/quote:19zd9jpr]
If you call it once (with no conditional), it will be processed for every
message

when you call the ruleset, if it has a queue the call just copies the
message into that queue, beyond that it doesn't matter how the message got
into that queue.