Hi-- On Aug 24, 2009, at 6:40 AM, Dirk H. Schulz wrote:
- is it possibe to configure a second remote rsyslog server to report to ONLY in case the primary syslog server is unreachable?
If you can configure IP-level redundancy via CARP or via something like load-balancer hardware from ServerIron/NetScaler/etc, sure. You're almost sure to have some network traffic fall through the cracks during the keepalive checking interval if a failover happens, but failing over should be a rare case.
However, heavily loaded syslog servers will quite happy drop some fraction of UDP traffic anyway from time to time, so this isn't too unusual.
- is it possible to configure buffers (RAM, disk) where undeliverable messages are buffered until they can be delivered?Any hint or help is appreciated.
Logging via a local filesystem domain socket (ie, /var/run/log or similar) is much more reliable that logging over remote network sockets. You might find adjusting sysctl kern.ipc.somaxconn and/or upping the second argument to listen() call in your syslogd will help.
Regards, -- -Chuck