Mailing List Archive: howto rsyslog HA with PCS (and keep local logs)

howto rsyslog HA with PCS (and keep local logs)

Aug 31, 2020, 1:27 AM

Post #1 of 5 (621 views)

Hi,

I've found a pcs cluster for rsyslog at work (quite old but it's not the
topic :) ), in active/passive mode (HA)

One resource on the cluster manage the rsyslog service (lsb:rsyslog), and
... the service rsyslog is configured too to run at start.

For me, with PCS if a service is managed by pcs, it must be disable at
system level.

But, if i disable rsyslog at system level, on the slave inactive node, i
got no more logs for local services, like /var/log/secure, messages,....

I try to find a how-to for this case, but hard even for google :) (find
only how to log PCS clustrs, ...)

Thx for any help.
David
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: howto rsyslog HA with PCS (and keep local logs) [ In reply to ]

rsyslog at lists

Aug 31, 2020, 2:35 AM

Post #2 of 5 (621 views)

Permalink

You can always use two instances of rsyslog. One for local logs and
another for forwarding logs from remote.

Of course you'll need to create a unit file for systemd to start
rsyslogd with your own config file.

I think that's the easiest approach.

Mariusz Kruk
Ekspert ds. Bezpiecze?stwa IT
COMP S.A.
Pion Cyberbezpiecze?stwa i Zarz?dzania Ryzykiem
e-mail: mariusz.kruk@comp.com.pl
e-mail: mariusz.kruk@safecomp.com
tel: +48 608 623 299

On 31.08.2020 10:27, David CAPG via rsyslog wrote:
> Hi,
>
> I've found a pcs cluster for rsyslog at work (quite old but it's not the
> topic :) ), in active/passive mode (HA)
>
> One resource on the cluster manage the rsyslog service (lsb:rsyslog), and
> ... the service rsyslog is configured too to run at start.
>
> For me, with PCS if a service is managed by pcs, it must be disable at
> system level.
>
> But, if i disable rsyslog at system level, on the slave inactive node, i
> got no more logs for local services, like /var/log/secure, messages,....
>
> I try to find a how-to for this case, but hard even for google :) (find
> only how to log PCS clustrs, ...)
>
> Thx for any help.
> David
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: howto rsyslog HA with PCS (and keep local logs) [ In reply to ]

rsyslog at lists

Aug 31, 2020, 4:26 AM

Post #3 of 5 (621 views)

Permalink

Hi.

On 31.08.20 10:27, David CAPG via rsyslog wrote:
> Hi,
>
> I've found a pcs cluster for rsyslog at work (quite old but it's not the
> topic :) ), in active/passive mode (HA)

What's PCS?

Is it Pacemaker Cluster?
https://clusterlabs.org/

> One resource on the cluster manage the rsyslog service (lsb:rsyslog), and
> ... the service rsyslog is configured too to run at start.
>
> For me, with PCS if a service is managed by pcs, it must be disable at
> system level.
>
> But, if i disable rsyslog at system level, on the slave inactive node, i
> got no more logs for local services, like /var/log/secure, messages,....
>
> I try to find a how-to for this case, but hard even for google :) (find
> only how to log PCS clustrs, ...)

Maybe this guide can help you to start your config.
https://www.rsyslog.com/storing-and-forwarding-remote-messages/

As Mariusz written you will have two services.
The local one and the remote one.

> Thx for any help.
> David
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: howto rsyslog HA with PCS (and keep local logs) [ In reply to ]

rsyslog at lists

Aug 31, 2020, 5:16 AM

Post #4 of 5 (621 views)

Permalink

Hi David,
we also run more instances of chrooted rsyslog in cluster setup. ATM just
simple hearbeat+ldirector+IPVS, but plan to upgrade to a full
featured cluster stack soon for better balancing of the load.
More information on our current setup available in my previous post [1].
For running more instances of rsyslog find the attached systemd service
file. Feel free to use it as the basis for your setup (you should remove
all the chrooting and pre/post exec's). Decide whether to read about the
instantioned services under systemd [2].

[1]
http://rsyslog-users.1305293.n2.nabble.com/rsyslog-in-HA-mode-tc7595885.html#a7595894

[2]
https://www.freedesktop.org/software/systemd/man/systemd.service.html#Service%20Templates

--
Peter

On Mon, Aug 31, 2020 at 11:35 AM Mariusz Kruk via rsyslog <
rsyslog@lists.adiscon.com> wrote:

> You can always use two instances of rsyslog. One for local logs and
> another for forwarding logs from remote.
>
> Of course you'll need to create a unit file for systemd to start
> rsyslogd with your own config file.
>
> I think that's the easiest approach.
>
> Mariusz Kruk
> Ekspert ds. Bezpiecze?stwa IT
> COMP S.A.
> Pion Cyberbezpiecze?stwa i Zarz?dzania Ryzykiem
> e-mail: mariusz.kruk@comp.com.pl
> e-mail: mariusz.kruk@safecomp.com
> tel: +48 608 623 299
>
> On 31.08.2020 10:27, David CAPG via rsyslog wrote:
> > Hi,
> >
> > I've found a pcs cluster for rsyslog at work (quite old but it's not the
> > topic :) ), in active/passive mode (HA)
> >
> > One resource on the cluster manage the rsyslog service (lsb:rsyslog), and
> > ... the service rsyslog is configured too to run at start.
> >
> > For me, with PCS if a service is managed by pcs, it must be disable at
> > system level.
> >
> > But, if i disable rsyslog at system level, on the slave inactive node, i
> > got no more logs for local services, like /var/log/secure, messages,....
> >
> > I try to find a how-to for this case, but hard even for google :) (find
> > only how to log PCS clustrs, ...)
> >
> > Thx for any help.
> > David
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.

Re: howto rsyslog HA with PCS (and keep local logs) [ In reply to ]

rsyslog at lists

Aug 31, 2020, 7:44 AM

Post #5 of 5 (621 views)

Permalink

Hi thx all for your quick answers and exemples.

First @peter they use PCS everywhere here, then will not try LVS or other
for now.

And globally, you confirm that we should have 2 rsyslog instances... will
make my report...

Le lun. 31 août 2020 à 14:16, Peter Viskup <skupko.sk@gmail.com> a écrit :

> Hi David,
> we also run more instances of chrooted rsyslog in cluster setup. ATM just
> simple hearbeat+ldirector+IPVS, but plan to upgrade to a full
> featured cluster stack soon for better balancing of the load.
> More information on our current setup available in my previous post [1].
> For running more instances of rsyslog find the attached systemd service
> file. Feel free to use it as the basis for your setup (you should remove
> all the chrooting and pre/post exec's). Decide whether to read about the
> instantioned services under systemd [2].
>
> [1]
> http://rsyslog-users.1305293.n2.nabble.com/rsyslog-in-HA-mode-tc7595885.html#a7595894
>
> [2]
> https://www.freedesktop.org/software/systemd/man/systemd.service.html#Service%20Templates
>
> --
> Peter
>
> On Mon, Aug 31, 2020 at 11:35 AM Mariusz Kruk via rsyslog <
> rsyslog@lists.adiscon.com> wrote:
>
>> You can always use two instances of rsyslog. One for local logs and
>> another for forwarding logs from remote.
>>
>> Of course you'll need to create a unit file for systemd to start
>> rsyslogd with your own config file.
>>
>> I think that's the easiest approach.
>>
>> Mariusz Kruk
>> Ekspert ds. Bezpiecze?stwa IT
>> COMP S.A.
>> Pion Cyberbezpiecze?stwa i Zarz?dzania Ryzykiem
>> e-mail: mariusz.kruk@comp.com.pl
>> e-mail: mariusz.kruk@safecomp.com
>> tel: +48 608 623 299
>>
>> On 31.08.2020 10:27, David CAPG via rsyslog wrote:
>> > Hi,
>> >
>> > I've found a pcs cluster for rsyslog at work (quite old but it's not the
>> > topic :) ), in active/passive mode (HA)
>> >
>> > One resource on the cluster manage the rsyslog service (lsb:rsyslog),
>> and
>> > ... the service rsyslog is configured too to run at start.
>> >
>> > For me, with PCS if a service is managed by pcs, it must be disable at
>> > system level.
>> >
>> > But, if i disable rsyslog at system level, on the slave inactive node, i
>> > got no more logs for local services, like /var/log/secure, messages,....
>> >
>> > I try to find a how-to for this case, but hard even for google :) (find
>> > only how to log PCS clustrs, ...)
>> >
>> > Thx for any help.
>> > David
>> > _______________________________________________
>> > rsyslog mailing list
>> > https://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>> you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Mailing List Archive

Mailing List Archive

Attached Files: