Score:1

Rsyslog not sending to server when filesystem fails

us flag

I have on my servers an rsyslog client, that supposed to send logs to rsyslog server. Recently there was an issue on one of the servers where the filesystem went into read-only. This caused local logs not being written. However on the remote log there were no entries either.

I guess that was because the services on the server couldn't write logs and thus the rsyslog can not send them, right? Is it possible to have logs written in some sort of a RAM disk before they get send via rsyslog to remote and local files? That RAM-disk would of course need a quota so that the server RAM doesn't get used up when there is a log flood.

Is In-Memory Queue the way to go here?

Part from the config:

*.notice;auth.!=notice          @<remote server IP>

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.