I'm running rsyslog 3.21.9 in RHEL 5 machine. The logs are written to MySQL DB properly. I just configured the disk spool and it seems working as well, almost.
The related configurations are:
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName dbq # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# Save the firewall logs to MySQL DB.
local5.* :ommysql:127.0.0.1,Syslog,rsyslogd,password
For testing, I manually shut down the MySQL. The rsyslogd started writing to the disk. After I started the DB, the new logs were written to DB again. The problem is I noticed the spool files are not flushed to the DB. They're left on the disk.
[root@alfnetengi01 rsyslog]#ls -l /var/spool/rsyslog/
...
-rw------- 1 root root 1049170 Apr 9 16:23 dbq.00000077
-rw------- 1 root root 209901 Apr 9 16:23 dbq.00000078
[root@alfnetengi01 rsyslog]# date
Thu Apr 9 17:14:48 EDT 2009
As shown above, the last spooled log was about a hour ago and it is still there. When the spooled logs will be written to the DB. Did I miss anything?
Thanks.

