MonitorWare Knowledge Base

Hi,

We have a problem with the ActionResume. In fact when the remote server is no more available, everything is writed on the queue (as expected ), but the problem come when the remote server is back : all message on the queue are merged in one message and sended to the remote server.

I've not found how to configure rsyslog to sended separate message.

Can you help me?

Best regards,


Vince

Here is my rsyslog .conf :

Code: Select all

#Global Parameter
#
$WorkDirectory /var/syslog      # default location for work (spool) files
$MainMsgQueueFileName mainq


#Instance parameter
#
$ActionQueueFileName dstats     # set file name, also enables disk mode
$ActionQueueMaxFileSize 100m    # max size of the disk queue log file
$ActionQueueSaveOnShutdown on   # all message are saved on shutdown if not sended to central server
$ActionQueueDiscardSeverity 6   # do not discard NOTICE messages!
$ActionResumeInterval 1
$ActionResumeRetryCount -1      # infinite retries on insert failure
$QueueDequeueSlowdown 1000
*.* @@x.x.x.x


• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Nobody has this problem?

Oops... looks like I have overlooked this message. Thanks for pinging.

What do you mean by "all in one message"? Can you please provide a sample. Also, what is the receiver? Is it also rsyslog.

Rainer

Thank you for your reply.

The remote syslog is a Winsyslog Server.

- After an Action Resume, messages from Rsyslog are seen by Winsyslog as 1 unique event.
- All merged message from Rsyslog are separate with a "\n" sequence.

So we have configured into "TCP option" from winsyslog to have that the message seaparation sequence to "\n"

Now we get ride of this "problem"

Next step : RFC3195 with encryption between rsyslog and Winsyslog

I'll look into this, it should actually not be a problem (should, as I said ).

I'd don't take the 3195 route: nobody is actually using it and thus the code has never received a practical drill-down. I don't consider it a viable production option. It's included mostly for completeness (and because we hoped it would evolve into something the people use, what it actually did not do until now).

Rainer

thank for your advise about rfc1395.

Is it possible to forward message from Rsyslog to Winsyslog via TLS? Because on WinSyslog TLS can only be applied with SETP receiver.

Thank you for your help.

Vince

Native TLS is a brand-new feature, one that even the standard is not yet specified. Commercial solutions are always a bit conservative, and so WinSyslog does not yet support it natively. What you can do, however, is use it together with stunnel, which is a good choice. I'll see that I can motivate someone to write a small guide on that (we are working on the failure case, so this comes in nicely as a co-activity ).

Rainer