12

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails.

*.* @@server1
*.* @@server2

If I put the above in /etc/rsyslog.conf, server2 will not receive any logs as long as server1 is up. How do I tell rsyslog to send to both servers no matter what?

Also, as an extra bonus, I would like to use 2 different local "buffer"-files for local storing if the remote servers goes down.

Daniele Testa
  • 631
  • 4
  • 10
  • 18

1 Answers1

18

From Forwarding to More than One Server;

What is important to know, however, is that the full set of directives make up an action. So you can not simply add (just) a second forwarding rule, but need to duplicate the rule configuration as well. Be careful that you use different queue file names for the second action, else you will mess up your system.

So, actually, you have to use 2 different local queues.

Configure a working directory.

$WorkDirectory /var/spool/rsyslog

Configure your forwarding rules (obsolete legacy format).

$ActionQueueType LinkedList
$ActionQueueFileName Forward1
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
*.* @@server1

$ActionQueueType LinkedList
$ActionQueueFileName Forward2
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
*.* @@server2

Configure your forwarding rules (new advanced format).

action(type="omfwd" target="server1" resumeRetryCount="-1" 
    queue.type="LinkedList" queue.filename="Forward1" queue.saveOnShutdown="on")

action(type="omfwd" target="server2" resumeRetryCount="-1" 
    queue.type="LinkedList" queue.filename="Forward2" queue.saveOnShutdown="on")
eDonkey
  • 113
  • 6
Aaron Copley
  • 12,345
  • 5
  • 46
  • 67
  • That is actually exactly the config I used, including the different queue-files. But it still does not work. I only see logs comming to "server2" if I turn off "server1" – Daniele Testa Jul 11 '13 at 06:51
  • Sorry, my bad. I had some wrong firewall rules :) My original config was working after I fixed the firewall issues. – Daniele Testa Jul 11 '13 at 14:50
  • 1
    Firewalls will do it every time.. I should have asked about that! :) Regardless of your existing config working, how about an upvote for my efforts? This site works best when the voting system encourages participation. Please see the [about] page when you get a chance. – Aaron Copley Jul 11 '13 at 15:06
  • 2
    Sorry, I need 15+ reputation to upvote – Daniele Testa Jul 11 '13 at 19:05