MonitorWare Knowledge Base

Hi,

I've tried to setup a client/server1/server2 configuration using docs and conf samples but it's not working as I expect to...

The client conf :

$ModLoad immark.so # provides --MARK-- message capability
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so # kernel logging (formerly provided by rklogd)

kern.* /var/log/kernel;RSYSLOG_TraditionalFileFormat
*.*;local2.none;local6.none;local3.none /opt/agarik/log/all.log
*.info;mail.none;authpriv.none;cron.none;local2.none;local3.none;local4.none;local5.none;local6.none;local7.none -/var/log/messages;RSYSLOG_TraditionalFileFormat
authpriv.* /var/log/secure;RSYSLOG_TraditionalFileFormat
mail.* -/var/log/maillog;RSYSLOG_TraditionalFileFormat
cron.* -/var/log/cron;RSYSLOG_TraditionalFileFormat
*.emerg *;RSYSLOG_TraditionalFileFormat
uucp,news.crit -/var/log/spooler;RSYSLOG_TraditionalFileFormat
local6.*;local6.!=warn /var/log/squid.log;RSYSLOG_TraditionalFileFormat
local6.warn /var/log/squid_access.log;RSYSLOG_TraditionalFileFormat
local7.* /var/log/boot.log;RSYSLOG_TraditionalFileFormat

# Remote Logging (we use TCP for reliable delivery)
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.

$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName uniqName # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down

*.* @@server1
$ActionExecOnlyWhenPreviousIsSuspended on
& @@server2
& /var/spool/rsyslog/buffer.log
$ActionExecOnlyWhenPreviousIsSuspended off

# ######### Receiving Messages from Remote Hosts ##########
# TCP Syslog Server:
# provides TCP syslog reception and GSS-API (if compiled to support it)
#$ModLoad imtcp.so # load module
#$InputTCPServerRun 514 # start up TCP listener at port 514

# UDP Syslog Server:
#$ModLoad imudp.so # provides UDP syslog reception
#$UDPServerRun 514 # start a UDP syslog server at standard port 514

So here I'm trying to send logs to server2 if server1 is down but when I stop rsyslog on server1, the client don't even tries to send packets to server2 and nothing is sent in the buffer.log file.

Can somebody tell me if something is wrong in my conf ?

Thanks.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

This can never fail, because you set it to infinite retries:

$ActionResumeRetryCount -1 # infinite retries if host is down

HTH
Rainer