14

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails.

*.* @@server1
*.* @@server2

If I put the above in /etc/rsyslog.conf, server2 will not receive any logs as long as server1 is up. How do I tell rsyslog to send to both servers no matter what?

Also, as an extra bonus, I would like to use 2 different local "buffer"-files for local storing if the remote servers goes down.

Improve this question

1 Answer 1

Reset to default
23

From Forwarding to More than One Server;

What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system.

So, actually, you have to use 2 different local queues.

Configure a working directory.

$WorkDirectory /var/spool/rsyslog

Configure your forwarding rules (obsolete legacy format).

$ActionQueueType LinkedList
$ActionQueueFileName Forward1
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
*.* @@server1

$ActionQueueType LinkedList
$ActionQueueFileName Forward2
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
*.* @@server2

Configure your forwarding rules (new advanced format).

action(type="omfwd" target="server1" resumeRetryCount="-1" 
    queue.type="LinkedList" queue.filename="Forward1" queue.saveOnShutdown="on")

action(type="omfwd" target="server2" resumeRetryCount="-1" 
    queue.type="LinkedList" queue.filename="Forward2" queue.saveOnShutdown="on")
Improve this answer
4
  • That is actually exactly the config I used, including the different queue-files. But it still does not work. I only see logs comming to "server2" if I turn off "server1"
    – Daniele Testa
    Commented Jul 11, 2013 at 6:51
  • Sorry, my bad. I had some wrong firewall rules :) My original config was working after I fixed the firewall issues.
    – Daniele Testa
    Commented Jul 11, 2013 at 14:50
  • 1
    Firewalls will do it every time.. I should have asked about that! :) Regardless of your existing config working, how about an upvote for my efforts? This site works best when the voting system encourages participation. Please see the tour page when you get a chance.
    – Aaron Copley
    Commented Jul 11, 2013 at 15:06
  • 2
    Sorry, I need 15+ reputation to upvote
    – Daniele Testa
    Commented Jul 11, 2013 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .