MonitorWare Knowledge Base

Hai,
I installed rsyslog in two systems and made one of them as server and the other as client. I made the log data of client written in server. I also made an attempt on writing the log data to the client's disk when the server is unreachable. It went good. Here arises a problem that in client's rsyslog.conf file I wrote like this

*.* @@Server's ip-address
$ActionExecOnlyIfPreviousIsSuspended on
& /var/log/localbuffer
$ActionExecOnlyIfPreviousIsSuspended off

Here the log messages are being written to /var/log/localbuffer of client even if the server is in reachable state.
So please help in solving this issue.

One more doubt is when the server is again in reachable state how can I see the log data of client which happened when the server is down, in server.

• Pulling out your Hair?
• Wasting Time and Money?
• Deadline Approaching?

question first: do you really want to write to somewhere else when the sever fails (but not forward it to the server) or do you like to have the client buffer data while the remote server is down and send it when it is back online? The later is done via queues. The sample rsyslog.conf that comes with the tarball has a commented-out sample in side it (towards the end of the file):

http://git.adiscon.com/?p=rsyslog.git;a ... 7d;hb=HEAD

Rainer

Hai,
Thanks for your quick reply. Actually what I need is to write the data with in the client when the server is not reachable and client should be able to send the data back to the server when ever it finds that server is reachable again.

Another problem is though I used the statement

$ActionExecOnlyIfPreviousIsSuspended on

after giving path to the log data to server it is being written in client even if the previous statement is working.

Hi,

you don't do this with a failover server. The failover capability is to redirect messages to somewhere else. To just buffer messages when the remote peer is offline, you need to use the queue. The sample config has everything you need to do so:

http://git.adiscon.com/?p=rsyslog.git;a ... 7d;hb=HEAD

It is in the two blocks towards the end of the file that are commented out.

HTH
Rainer

Hai,

On my request please keep aside the failover Syslog server. Please answer this.

I have a two systems using rsyslog, one client and the other server. At one time the server is down. I don't need to write the log data of client to be written in client at that particular time(ie,. when the server is unreachable). What I want is after the server comes to a reachable state I want to see the log data of client which occurred in client when the server is down in server's database.

This is done in the example I suggested

There is no elaborate doc (yet) on the forwarding case. However, you can look at the database case for more details. It works along the same line of processing:

http://www.rsyslog.com/doc-rsyslog_high ... _rate.html

But, again, all you need is the config code that I quoted in my postings above...

Does that help?

Rainer

Hai,
The problem is not solved. Here I am little bit confused. I want to store the log data from client when the server is off in \var\log\spooler.
then what should I give in the below lines in my configuration file of client.

$WorkDirectory /rsyslog/spool # where to place spool files

$ActionQueueFileName uniqName # unique name prefix for spool files

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

$ActionQueueType LinkedList # run asynchronously

$ActionResumeRetryCount -1 # infinite retries if host is down

I did not modify my server's configuration file. It is the same which worked with tcp.

You are almost there. This is the code on the client:

Code: Select all

$WorkDirectory /rsyslog/spool # default location for work (spool) files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd   # set file name, also enables disk mode
$ActionResumeRetryCount -1  # infinite retries on forwarding failure
*.*      @@server


It is *vital* that *.* @@server *immediately* *follows* the config statements. In any case, I will now also create a howto for this situation.

Let me know if that helps.

Rainer

Hai,

It did not help. In your recent reply you did not specify the location where to store the log data. In normal use of rsyslog there is no location /rsyslog/spool.

Ah, I now see your problem. You need to create that directory. It is quite irrelevant where you store it, rsyslog doesn't care. But you must create a directory and point rsyslog to it. So you could also use /home/tra/la/la/some/where - it doesn't matter

But good to know, creating the directory should go into the howto

Rainer

Hai,

I have already given the path /var/log/spool in place of /rsyslog/spool. But it did not work.
If we give the above path for $WorkDirectory

then what should we give for $ActionQueueFileName

$ActionQueueFileName must be a unique name. You can use srvrfwd as I suggested or anything else that forms a valid filename. Make sure that you created /var/log/spool

Hai,
First of all thanks for your continues reply.
What I did after your recent post is , I created a directory named spool in /var/log and a file in spool named srvrfwd.
In all my trails past the server is unreachable. But no change. Still the file srvrfwd in/var/log/spool is empty with out any data.

You must not create the file. It is auto-created when needed. I suggest you review the database link on how the queuing works. Or wait a few more minutes, I am right now working on the howto...

First shot at the howto:

http://www.rsyslog.com/doc-rsyslog_reli ... rding.html

It is not perfect, but should cover your last question. I am expanding it right now. Please report any problem you have, that helps me improving it

Rainer