Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using rsyslog to forward syslog entries from a pile of servers to Loggly

The configuration looks something like this:

# Config for loggly upload
*.* @@logs.loggly.com:12345

This works, but because it's forwarding, any log entries which occur when there isn't an internet connection never make it to loggly.

Is there anyway I can configure rsyslog to "hold" log entries until an internet connection is established, and then send them? Or is there another tool I should be using for this?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Rsyslog is able to buffer messages to disk if it is unable to contact a remote server. The default rsyslog.conf on my Fedora system includes the following example:

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# 
### end of the forwarding rule ###

The configuration is explain detail in this document.

share|improve this answer
1  
Dang. You beat me as I was just typing all that out since I couldn't copy/paste it. :) –  Aaron Copley Feb 10 '12 at 19:44

syslog-ng can buffer logs to disk if it can't send them to the server.

 destination d_tcp { tcp(“logserver” log_disk_fifo_size(100000000)); };
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.