I am doing remote logging with relp for all my log files, but I want to
write *one* log file locally, I thought I could just bind a new imuxsock
to the syslog socket input to a ruleset and that would work, but I'm
getting inconsistent results where some logs make it locally and some
not, but the rest do manage to make it remotely.
My configuration is fairly simple, but something must not be right, can
someone suggest a fix for this?
In /etc/rsyslog.conf, I have:
global(
maxMessageSize="64k"
)
module(load="imuxsock"
SysSock.Use="off"
)
module(load="imkmsg")
module(
load="omprog"
)
module(
load="omrelp"
tls.tlslib="openssl"
)
$DefaultRuleset incoming
input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="incoming")
$IncludeConfig /etc/rsyslog.d/*.conf
and then in /etc/rsyslog.d/00_client.conf I have:
ruleset(name="incoming") {
# Send remote
action(type="omrelp"
target="woodpecker-pn.riseup.net"
port="6515"
tls="on"
tls.compression="on"
tls.authmode="certvalid"
tls.permittedpeer="woodpecker.riseup.net"
tls.cacert="/etc/certs/roots/riseup.pem"
tls.mycert="/etc/certs/client/certs/etherpadlite.riseup.net/etherpadlite.riseup.net_server.crt"
tls.myprivkey="/etc/certs/client/keys/etherpadlite.riseup.net/etherpadlite.riseup.net_server.key"
action.resumeRetryCount="-1"
action.resumeInterval="2"
action.reportSuspension="on"
queue.workerthreads="4"
queue.size="50000"
queue.spoolDirectory="/var/spool/rsyslog"
queue.filename="remote"
queue.maxfilesize="64m"
queue.maxdiskspace="2g"
queue.type="LinkedList"
queue.saveonshutdown="on"
)
}
and in /etc/rsyslog.d/etherpad-lite.conf, I have:
ruleset(name="etherpad") {
if $programname == "etherpad-lite" then {
/var/log/etherpad-lite/etherpad-lite.log
}
}
input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="etherpad")
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
write *one* log file locally, I thought I could just bind a new imuxsock
to the syslog socket input to a ruleset and that would work, but I'm
getting inconsistent results where some logs make it locally and some
not, but the rest do manage to make it remotely.
My configuration is fairly simple, but something must not be right, can
someone suggest a fix for this?
In /etc/rsyslog.conf, I have:
global(
maxMessageSize="64k"
)
module(load="imuxsock"
SysSock.Use="off"
)
module(load="imkmsg")
module(
load="omprog"
)
module(
load="omrelp"
tls.tlslib="openssl"
)
$DefaultRuleset incoming
input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="incoming")
$IncludeConfig /etc/rsyslog.d/*.conf
and then in /etc/rsyslog.d/00_client.conf I have:
ruleset(name="incoming") {
# Send remote
action(type="omrelp"
target="woodpecker-pn.riseup.net"
port="6515"
tls="on"
tls.compression="on"
tls.authmode="certvalid"
tls.permittedpeer="woodpecker.riseup.net"
tls.cacert="/etc/certs/roots/riseup.pem"
tls.mycert="/etc/certs/client/certs/etherpadlite.riseup.net/etherpadlite.riseup.net_server.crt"
tls.myprivkey="/etc/certs/client/keys/etherpadlite.riseup.net/etherpadlite.riseup.net_server.key"
action.resumeRetryCount="-1"
action.resumeInterval="2"
action.reportSuspension="on"
queue.workerthreads="4"
queue.size="50000"
queue.spoolDirectory="/var/spool/rsyslog"
queue.filename="remote"
queue.maxfilesize="64m"
queue.maxdiskspace="2g"
queue.type="LinkedList"
queue.saveonshutdown="on"
)
}
and in /etc/rsyslog.d/etherpad-lite.conf, I have:
ruleset(name="etherpad") {
if $programname == "etherpad-lite" then {
/var/log/etherpad-lite/etherpad-lite.log
}
}
input(type="imuxsock" Socket="/run/systemd/journal/syslog" ruleset="etherpad")
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.