rsyslog failover config and queues (ruleset or action)

General discussions here

Moderator: rgerhards

Google Ads


rsyslog failover config and queues (ruleset or action)

Postby jdafoe » Tue Aug 22, 2017 4:37 pm

Hello,

Looking for advice on the better way to configure queues for failover destinations (at the ruleset or at the action level or both?).

Currently we are using the following configuration, which uses default queue params for the ruleset (in memory) and a larger disk-assisted queue for the action (when both primary and failover destinations are down).

Code: Select all
#######################################################################
# RuleSet
#######################################################################
ruleset( name="1523" queue.type="LinkedList" ) {

        # Log all traffic to hourly log
        action   ( type="omfile"
                   name="1523_to_file"
                   dynaFile="1523_hourly_log"
                   dynaFileCacheSize="50"
                   template="rawformat_disk"
                   failOnChOwnFailure="off"
                   ioBufferSize="512"
        )

          # Send to primary destination
          action ( type="omfwd"
                   name="1523_to_primary"
                   target="10.10.10.11"
                   port="15230"
                   protocol="tcp"
                   template="rawformat_remote"
          )

          # If primary down, send to failover
          action ( type="omfwd"
                   name="1523_to_failover"
                   target="10.10.10.12"
                   port="15230"
                   protocol="tcp"
                   template="rawformat_remote"
                   action.execOnlyWhenPreviousIsSuspended="on"
          )

          # If both Primary & Failover down, queue messages indefinitely until primary comes back
          action ( type="omfwd"
                   name="1523_to_queue"
                   target="10.10.10.11"
                   port="15230"
                   protocol="tcp"
                   template="rawformat_remote"
                   queue.type="LinkedList"
                   queue.spoolDirectory="/logs"
                   queue.filename="1523_queue"
                   queue.saveOnShutdown="on"
                   queue.size="500000"
                   queue.highWaterMark="300000"
                   queue.lowWaterMark="50000"
                   queue.maxFileSize="100m"
                   queue.maxDiskSpace="10g"
                   action.execOnlyWhenPreviousIsSuspended="on"
                   action.resumeRetryCount="-1"
          )

}



I've seen other users configurations, where the disk assisted queue is at the ruleset level and direct queues are used for the actions. There is also no action.resumeRetryCount="-1" specified. Is the following config better (in terms of reducing message loss)? Is one recommended over the other?


Code: Select all

#######################################################################
# RuleSet
#######################################################################
ruleset(
            name="1523"
            queue.type="LinkedList"
            queue.spoolDirectory="/logs"
            queue.filename="1523_queue"
            queue.saveOnShutdown="on"
            queue.size="500000"
            queue.highWaterMark="300000"
            queue.lowWaterMark="50000"
            queue.maxFileSize="100m"
            queue.maxDiskSpace="10g"
) {
        # Log all traffic to hourly log
        action   ( type="omfile"
                   name="1523_to_file"
                   dynaFile="1523_hourly_log"
                   dynaFileCacheSize="50"
                   template="rawformat_disk"
                   failOnChOwnFailure="off"
                   ioBufferSize="512"
        )

          # Send to primary destination
          action ( type="omfwd"
                   name="1523_to_primary"
                   target="10.10.10.11"
                   port="15230"
                   protocol="tcp"
                   template="rawformat_remote"
          )

          # If primary down, send to failover
          action ( type="omfwd"
                   name="1523_to_failover"
                   target="10.10.10.12"
                   port="15230"
                   protocol="tcp"
                   template="rawformat_remote"
                   action.execOnlyWhenPreviousIsSuspended="on"
          )
}
jdafoe
New
 
Posts: 1
Joined: Tue Aug 22, 2017 4:00 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Google Ads


Return to General

Who is online

Users browsing this forum: No registered users and 0 guests

cron