[rsyslog-notify] Forum Thread: Re: fwd local msg, two listeners to remote server w/TLS, Que - (Mode 'reply')

[noreply at adiscon.com]

User: atticus 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26632#p26632

Message: 
----------
Subtle indeed.  Reading this 1st point several times again, I thought I got
it, but I realize I didn't.  You're saying in the way I've written my
queueing statment on FWD1 (the only one I think I need it for, since thats
the omfwd...) won't work.  I've written it as this:  it's part of the
ACTION statement:

RULESET (NAME=”FWD1”) {
ACTION(TYPE="OMFWD" TARGET="GROUP1.EX.COM" PORT="10514" PROTOCOL="TCP"
QUEUE.FILENAME="GROUP1Q" QUEUE.SAVEONSHUTDOWN =”ON” QUEUE.TYPE="LINKEDLIST"
STREAMDRIVERMODE="1" STREAMDRIVER="GTLS"etc.

Should it be like this?  I had seen this once before but read later it was
supposed to go in the action statement.

RULESET (NAME=”FWD1” queue.filename="group1q", queue.saveonshutdown="on",
queue.type="linklist")
{

ACTION(TYPE="OMFWD" TARGET="GROUP1.EX.COM" PORT="10514" PROTOCOL="TCP"
QUEUE.FILENAME="GROUP1Q" QUEUE.SAVEONSHUTDOWN =”ON” QUEUE.TYPE="LINKEDLIST"
STREAMDRIVERMODE="1" STREAMDRIVER="GTLS"etc.)
when a new message is handled by an input, it puts that message in a queue.
This is either the main queue or the ruleset queue if one is defined.

Then a worker thread runs against this queue and processes messages
(including moving them to an action queue if needed)

so with your current config, messages from all sources mix in the main
queue and then are split into the different rulesets for processing. If the
local disk fills up or has an error that prevents writing local messages,
the main queue will fill up and processing will stop for everything. If you
had a separate queue on the ruleset you tie to specific inputs, then
processing for those would continue.

This is a subtle thing.