From 3aaa3ac894b21a21fb601e1a74664cb795e8e39b Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 2 Aug 2007 16:23:39 +0000 Subject: added $ActionExecOnlyIfPreviousIsSuspended config directive --- doc/rsyslog_conf.html | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/doc/rsyslog_conf.html b/doc/rsyslog_conf.html index 85a902ff..73f71986 100644 --- a/doc/rsyslog_conf.html +++ b/doc/rsyslog_conf.html @@ -28,6 +28,35 @@ specifies a pattern of facilities and priorities belonging to the specified action.

Lines starting with a hash mark ("#'') and empty lines are ignored. +

ActionExecOnlyIfPreviousIsSuspended

+

This directive allows to specify if actions should always be executed ("off," +the default) or only if the previous action is suspended ("on"). This directive +works hand-in-hand with the multiple actions per selector feature. It can be +used, for example, to create rules that automatically switch destination servers +or databases to a (set of) backup(s), if the primary server fails. Note that +this feature depends on proper implementation of the suspend feature in the +output module.

+

The following is an example of what can be done with it (a config file +excerpt):

+

*.* @@primary-syslog.example.com
+$ActionExecOnlyIfPreviousIsSuspended on
+&   @@secondary-1-syslog.example.com    # & is used to +have more than one action for
+&   @@secondary-2-syslog.example.com    # the same +selector - the mult-action feature
+&   /var/log/localbuffer
+$ActionExecOnlyIfPreviousIsSuspended off # to re-set it for the next selector

+

This selector processes all messages it receives (*.*).  It tries to +forward every message to primary-syslog.example.com (via tcp). If it can not +reach that server, it tries secondary-1-syslog.example.com, if that fails too, +it tries secondary-2-syslog.example.com. If neither of these servers can be +connected, the data is stored in /var/log/localbuffer. Please note that the +secondaries and the local log buffer are only used if the one before them does +not work. So ideally, /var/log/localbuffer will never receive a message. If one +of the servers resumes operation, it automatically takes over processing again.

+

We strongly advise not to use repeated line reduction together with +ActionExecOnlyIfPreviousIsSuspended. It may lead to "interesting" and undesired +results (but you can try it if you like).

Allowed Sender Lists

Allowed sender lists can be used to specify which remote systems are allowed to send syslog messages to rsyslogd. With them, further hurdles can be placed @@ -598,10 +627,10 @@ filters. An example would be

& root
& /var/log/critmsgs

These three lines send critical messages to the usrs rger and root and also -store them in /var/log/critmsgs. Using multiple actions per selector is -convenient and also comes with a performance benefit. As the filter needs to be -evaluated only once, there is less computation required to process the directive -compared to these otherwise-equal config directives:

+store them in /var/log/critmsgs. Using multiple actions per selector is +convenient and also offers a performance benefit. As the filter needs to +be evaluated only once, there is less computation required to process the +directive compared to the otherwise-equal config directives below:

*.=crit rger
*.=crit root
*.=crit /var/log/critmsgs

-- cgit v1.2.3