In rsyslog 5.8.10 remote logging is getting stopped if the server is down and then client queue size didn't exceed beyond a certain limit.

Solution Verified - Updated -

Issue

  • In rsyslog 5.8.10, customer reported an issue that during setting up a remote logging system, the logs were not being sent to the server if during transmission, we stop the daemon in server and then start it again. Ideally, the client should save the logs in the on-disk queue and then they will be transmitted when the server is functioning again.

  • In addition to scenario 1, it was also observed that when rsyslogd daemon in server is not running, the queue size in client is not increasing beyond a certain threshold of 396 KiB. Point to note is that in this case, $ActionQueueSize directive was not in use.

  • The relevant configuration which showed these two problems is this snippet.

$WorkDirectory /var/spool/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType Disk
$ActionResumeRetryCount -1
*.* @@collector1:514

Environment

  • Red Hat Enterprise Linux 6.3
  • rsyslog 5.8.10

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.