MonitorWare Knowledge Base

Hi,

i'm trying to set up my central rsyslog-server to log messages directly to a nfs share. however, i need some method to deal with the possible situation of that nfs share being unavailable. ideally, the messages would then be buffered in the same way as i have set up on the clients as described in http://www.rsyslog.com/doc-rsyslog_reli ... rding.html.

however, i cant make it work. any ideas?

//Adam

config snippet:
*********************************************
$template DYNmessages,"/data/temp/log/tcp/HOSTS/%HOSTNAME%/%$year%/%$month%/%$day%/messages"

WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd1 # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
if $inputname != 'imudp' \
and $syslogseverity-text != 'debug' \
and ( $syslogfacility-text != 'mail' and $syslogfacility-text != 'authpriv' and $syslogfacility-text != 'cron' ) \
then ?DYNmessages
# ### end forwarding rule ###
*********************************************

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

umm.. plainly: that is not currently possible (but reminds me that I wanted to look at the file output so that it supports restartable actions).

Sorry...

Rainer

wow, fast reply!

ok, i'll try to think of a workaround or something.

thanks!

would you be willing to test a devel version and work with me? I could probably add this quickly (no promise), but I currently have no time for real testing...

sure, i'll be happy to try to help!

ok, bear with me a little, will try to look at code asap. If you are curios, you can check http://twitter.com/rgerhards to see what I am working on.

Rainer

OK, this looks like it was way tooooooo trivial, anyhow. A tarball is available here:

http://git.adiscon.com/?p=rsyslog.git;a ... 469;sf=tgz

You need to run

$ autoreconf -vfi

before you call ./configure (as usual).

I did absolutely no testing, but I'd say 70% chance it works. Please report back.

You can also pull from git, the branch is "omfile-errHandler".

Rainer

ran into some problems - the autoconf i have access to is too old (2.59).

args - let me create a temporary tarball...

here we go: http://download.rsyslog.com/rsyslog/tmp.tar.gz (can change at any time )

hm, same problem:

[root@lxserv140 rsyslog-4.1.5]# autoreconf -vfi
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: aclocal --force -I m4
configure.ac:4: error: Autoconf version 2.61 or higher is required
configure.ac:4: the top level
autom4te: /usr/bin/m4 failed with exit status: 63
aclocal: autom4te failed with exit status: 63
autoreconf: aclocal failed with exit status: 63

you don't need the autoreconf with that tarball - it's a regular distribution tarball

ok, got it running - but my configuration does not work, the messages are discarded if the nfs mount is unavailable.

is my original configuration supposed to work?

i should probably say that the initial problem was that if the nfs mount is unavailable rsyslog of course just writes to local disk. to get around this and force rsyslog to encounter an error when trying this i made "chattr +i" on the nfs mount dir. this worked, rsyslog cant write there but discards the messages. a better way to fix that might be to use the drop privileges config, but this was not available in my rsyslog version.

the config looks fine. Can you create a debug log http://www.rsyslog.com/doc-troubleshoot.html while NFS goes offline and mail me the output (rgerhards@gmail.com, but ping me here when you have done). Maybe I can see something from the log (should so), if not, I need to do some testing, which probably means next week

debug output sent!