Howdy folks,
I'm trying to get an odd use-case working for omfwd (UDP), and was
wondering how I can configure rsyslog to make this happen.
When my system first comes online, it may not have a route to the syslog
server, and rsyslog correctly gets errors from sendto and suspends the
target. So far so good.
What I'd like to do is persist all the messages until we do have the route,
and then send them all. I suspect this involves a queue for the action,
with some retries.
Additionally, I'd like to suppress the (many) messages around the target
being suspended. It appears omfwd doesn't
respect action.reportSuspension="off" or
action.reportSuspensionContinuation="off"
Am I doing something wrong? How can I configure rsyslog to achieve these
goals?
Thanks,
Daniel
Example action:
*.* action(type="omfwd" Target="x.x.x.x" Port="yyy"
queue.type="LinkedList" action.resumeInterval="10"
action.resumeRetryCount="10" action.reportSuspension="off"
action.reportSuspensionContinuation="off")
Contents of /var/log/messages:
2020-09-24T11:29:30.167414-07:00 a rsyslogd: omfwd/udp: socket 5: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167427-07:00 a rsyslogd: omfwd/udp: socket 11: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167433-07:00 a rsyslogd: omfwd: socket 5: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167441-07:00 a rsyslogd: action
'action-3-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There
should be messages before this one giving the reason for suspension.
[v8.2008.0 try https://www.rsyslog.com/e/2007 ]
2020-09-24T11:29:30.167448-07:00 a rsyslogd: omfwd: socket 11: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167456-07:00 a rsyslogd: action
'action-4-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There
should be messages before this one giving the reason for suspension.
[v8.2008.0 try https://www.rsyslog.com/e/2007 ]
2020-09-24T11:29:30.167464-07:00 a rsyslogd: omfwd/udp: socket 1: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167472-07:00 a rsyslogd: omfwd/udp: socket 2: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167476-07:00 a rsyslogd: omfwd: socket 1: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167480-07:00 a rsyslogd: omfwd: socket 2: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I'm trying to get an odd use-case working for omfwd (UDP), and was
wondering how I can configure rsyslog to make this happen.
When my system first comes online, it may not have a route to the syslog
server, and rsyslog correctly gets errors from sendto and suspends the
target. So far so good.
What I'd like to do is persist all the messages until we do have the route,
and then send them all. I suspect this involves a queue for the action,
with some retries.
Additionally, I'd like to suppress the (many) messages around the target
being suspended. It appears omfwd doesn't
respect action.reportSuspension="off" or
action.reportSuspensionContinuation="off"
Am I doing something wrong? How can I configure rsyslog to achieve these
goals?
Thanks,
Daniel
Example action:
*.* action(type="omfwd" Target="x.x.x.x" Port="yyy"
queue.type="LinkedList" action.resumeInterval="10"
action.resumeRetryCount="10" action.reportSuspension="off"
action.reportSuspensionContinuation="off")
Contents of /var/log/messages:
2020-09-24T11:29:30.167414-07:00 a rsyslogd: omfwd/udp: socket 5: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167427-07:00 a rsyslogd: omfwd/udp: socket 11: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167433-07:00 a rsyslogd: omfwd: socket 5: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167441-07:00 a rsyslogd: action
'action-3-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There
should be messages before this one giving the reason for suspension.
[v8.2008.0 try https://www.rsyslog.com/e/2007 ]
2020-09-24T11:29:30.167448-07:00 a rsyslogd: omfwd: socket 11: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167456-07:00 a rsyslogd: action
'action-4-builtin:omfwd' suspended (module 'builtin:omfwd'), retry 0. There
should be messages before this one giving the reason for suspension.
[v8.2008.0 try https://www.rsyslog.com/e/2007 ]
2020-09-24T11:29:30.167464-07:00 a rsyslogd: omfwd/udp: socket 1: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167472-07:00 a rsyslogd: omfwd/udp: socket 2: sendto()
error: Network is unreachable [v8.2008.0 try https://www.rsyslog.com/e/2354
]
2020-09-24T11:29:30.167476-07:00 a rsyslogd: omfwd: socket 1: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
2020-09-24T11:29:30.167480-07:00 a rsyslogd: omfwd: socket 2: error 101
sending via udp: Network is unreachable [v8.2008.0 try
https://www.rsyslog.com/e/2354 ]
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.