1. rsyslog的tcp远程记录日志，如果远程主机端口宕掉，可以配置成先写本地文件队列，配置如下：
|
1 2 3 4 5 6 7 8 9 10 |
$WorkDirectory /var/rsyslog/spool $ActionQueueFileName uniqName # unique name prefix for spool files $ActionQueueMaxDiskSpace 10m # 1gb space limit (use as much as possible) $ActionQueueSaveOnShutdown on # save messages to disk on shutdown $ActionQueueType LinkedList # run asynchronously $ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional local0.* @@192.168.0.1:1234 |
注意： 指定的目录需要手动创建
每个tcp端口可以配置一个队列文件，队列文件不是实时写入到，当服务stop到时候（或者bufer满到时候）才会生成队列文件，配置多个tcp到队列文件如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
$WorkDirectory /var/rsyslog/spool $ActionQueueFileName uniqName1234 # unique name prefix for spool files $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) $ActionQueueSaveOnShutdown on # save messages to disk on shutdown $ActionQueueType LinkedList # run asynchronously $ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional local0.* @@192.168.0.1:1234 $ActionQueueFileName uniqName1235 # unique name prefix for spool files $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) $ActionQueueSaveOnShutdown on # save messages to disk on shutdown $ActionQueueType LinkedList # run asynchronously $ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional local0.* @@192.168.0.1:1235 |