我正在使用rsyslog将一堆服务器的系统日志条目转发到Loggly
configuration看起来像这样：
# Config for loggly upload *.* @@logs.loggly.com:12345
这是有效的，但是因为它是转发的，所以当没有互联网连接时发生的任何日志条目都不会使其变为logally。
有没有反正我可以configurationrsyslog“持有”日志条目，直到互联网连接build立，然后发送它们？ 还是有另一个工具，我应该用这个？
如果Rsyslog无法联系远程服务器，则可以将其caching到磁盘。 我的Fedora系统上的默认rsyslog.conf包含以下示例：
# ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, eg 192.168.0.1:514, port optional #*.* @@remote-host:514 # ### end of the forwarding rule ###
本文档中的configuration详细说明 。
如果syslog-ng无法将日志发送到服务器，它可以将日志缓冲到磁盘。
destination d_tcp { tcp(“logserver” log_disk_fifo_size(100000000)); };