search for: actionqueuefilenam

I have multiple servers running stock CentOS 7 rsyslog 7.4.7-16.el7, which are configured to log locally and over TCP to a remote logserver, also running stock CentOS 7 rsyslog. The remote server uses imptcp to receive, and pretty basic rules to parse and commit to disk. I have several systems that log prolifically, but periodically, they stop soon after the remote log server HUPs (daily

..."unreliable" network with buffer/queue and also when the receiver had his main msg queue size too small. Some parameters that can help (?) : # sender size $WorkDirectory /var/lib/rsyslog # default location for work (spool) files $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName forwardqueue # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down # receiver side $MainMsgQueueSize 100000 -- Fabian Arrotin The CentOS Project | http://www.centos.org g...

...* + +# Save news errors of level crit and higher in a special file. +uucp,news.crit /var/log/spooler + +# Save boot messages also to boot.log +local7.* /var/log/boot.log + +\$WorkDirectory /var/spool/rsyslog +\$ActionQueueFileName ovirtNode +\$ActionQueueMaxDiskSpace 10m +\$ActionQueueSaveOnShutdown on +\$ActionQueueType LinkedList +\$ActionResumeRetryCount -1 +*.* %(delim)s%(server)s:s(port)s +""" + + +def ovirt_rsyslog(server, port, protocol): + if protocol == "tcp": + DELIM="@@&quo...

...ogger:?????????????????????????????? [? OK? ] ??? Starting system logger:??????????????????????????????????? [? OK? ] ? On the client, I added to /etc/rsyslog.conf: ??? $ModLoad?????????????????? omrelp ??? $WorkDirectory???????????? /var/spool/rsyslog ??? $ActionQueueType?????????? LinkedList ??? $ActionQueueFileName?????? syslogfwd ??? $ActionQueueMaxDiskSpace?? 10g ??? $ActionResumeRetryCount??? -1 ??? $ActionQueueSaveOnShutdown on ??? *.*??????????????????????? :omrelp:xxx.xxx.xxx.xxx:20514 ? And restarted the daemon: ??? sudo service rsyslog restart ??? Shutting down system logger:?????????????????????????...

...y done by rklogd) + +\$GSSForwardServiceName rsyslog +\$GssMode encryption + +#### GLOBAL DIRECTIVES #### + +# Use default timestamp format +\$ActionFileDefaultTemplate RSYSLOG_TraditionalForwardFormat + +#### RULES #### + +# Forward all messages to ovirt controller +\$WorkDirectory /var/rsyslog +\$ActionQueueFileName ovirt-server-fwd +\$ActionQueueMaxDiskSpace 1g +\$ActionQueueSaveOnShutdown off +\$ActionQueueType LinkedList # run asynchronously +\$ActionResumeRetryCount -1 # infinite retries if host is down +*.* :omgssapi:$SRV_HOST:$SRV_PORT +# End forwarding Rule + +# Log anything (except mail) of level...