- Slowing down machine if syslog server not available
- We had an issue where the syslog was slowing down a machine because one of the syslog servers was not available.
- Currently we forward everything to 2 syslog servers with the following rules
*.* @@loghost1.example.org *.* @@loghost2.example.org
- What would be the best solution to prevent the system from slowing down? I was thinking of using queues.
$WorkDirectory /var/spool/rsyslog $ActionQueueType LinkedList $ActionQueueFileName rsyslog $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on $ActionResumeInterval 10 $ActionQueueSize 50000 $ActionQueueDiscardMark 40000 $ActionQueueHighWaterMark 40000 $ActionQueueCheckpointInterval 100 $ActionQueueMaxDiskSpace 2g $ActionQueueTimeoutEnqueue 10 $ActionQueueDiscardSeverity 0
- Is there better ways to solve this issue?
- We don't like to use disk queues but just memory.
- I guess I still need to define the QueueFileName as I have to use 2 different queues.
- How can I prevent from dumping to disk?
- Red Hat Enterprise Linux 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.