Hi Rainer,
We're using rsyslog(3.20.0) as our central logging server and clients.
We experienced an DISK ERROR on server last month. At that time, we were
using TCP to transport logs from client to server. And we also setup the
configuration just like [1]. But unfortunately our central logging
server got DISK error for one hour. So we lost logfiles of that period
of time.
I've a look at doc [1] carefully, I guess "RELIABLE" only means when
server got offline or rsyslogd on it isn't running, then clients will
save logs in buffer or write to a file on disk. If server is still
online and rsyslogd is running, but with IO/Error or Disk Full, then
client will still transfer logs to server even with RELP, coz I guess
RELP only protects logs could be transferred via network successfully,
it doesn't care the logs are written successfully to file on server. Am
I right?
So I guess if we need to prevent this, we need do some work on server?
Do we have some "directives" options that we could transfer logs to a
failover server if local disk fails or buffer in memory before disk got
corrected?
[1]: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html
Thanks,
--
Patrick Shen
Operations Engineer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
We're using rsyslog(3.20.0) as our central logging server and clients.
We experienced an DISK ERROR on server last month. At that time, we were
using TCP to transport logs from client to server. And we also setup the
configuration just like [1]. But unfortunately our central logging
server got DISK error for one hour. So we lost logfiles of that period
of time.
I've a look at doc [1] carefully, I guess "RELIABLE" only means when
server got offline or rsyslogd on it isn't running, then clients will
save logs in buffer or write to a file on disk. If server is still
online and rsyslogd is running, but with IO/Error or Disk Full, then
client will still transfer logs to server even with RELP, coz I guess
RELP only protects logs could be transferred via network successfully,
it doesn't care the logs are written successfully to file on server. Am
I right?
So I guess if we need to prevent this, we need do some work on server?
Do we have some "directives" options that we could transfer logs to a
failover server if local disk fails or buffer in memory before disk got
corrected?
[1]: http://www.rsyslog.com/doc-rsyslog_reliable_forwarding.html
Thanks,
--
Patrick Shen
Operations Engineer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com