Mailing List Archive

Remote Logging Issues
So I've enabled rsyslog on many of my servers to log to a centralized
server. I have them configured to use TCP. This weekend during a disaster
response test, the remote logging server was downed. At that point, the
clients sending log messages had major difficulties. SSH logins started
hanging up, anything writing to the log just sat there. I turned the
remote logging server back on and all was well. How can I fix this? I have
switched to UDP logging for now, but would like to return to TCP logging
as I would like to do encryption of the log stream.

~Dave
Remote Logging Issues [ In reply to ]
Hi Dave,

that's a downside of reliable logging - if you make the system wait for
the remote server. In rsyslog, you can have a queue in front of the
logging action. That should solve the problem. Real-world feedback is
appreciated. A setup is (commented out) in the sample rsyslog.conf:

http://git.adiscon.com/?p=rsyslog.git;a=blob;f=rsyslog.conf;h=9a91823ca7
c96c246936381b203770c08b433f7d;hb=HEAD

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of David_Greco at harte-hanks.com
> Sent: Monday, June 02, 2008 3:20 PM
> To: rsyslog at lists.adiscon.com
> Subject: [rsyslog] Remote Logging Issues
>
> So I've enabled rsyslog on many of my servers to log to a centralized
> server. I have them configured to use TCP. This weekend during a
> disaster
> response test, the remote logging server was downed. At that point,
the
> clients sending log messages had major difficulties. SSH logins
started
> hanging up, anything writing to the log just sat there. I turned the
> remote logging server back on and all was well. How can I fix this? I
> have
> switched to UDP logging for now, but would like to return to TCP
> logging
> as I would like to do encryption of the log stream.
>
> ~Dave
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog