Suppose 1 PC on linux sends logs to 2 PCs on linux using rsyslog. At some point, 2 PCs turn off, and 1 PC in theory continues to send logs to it. Is it possible to somehow stop this transfer or to make some kind of buffer into which these events “merge” until 2 PCs are turned on?
|
1 answer
Yes it is possible. Check out the failover in rsyslog. In your case (no secondary servers), the configuration will be as follows:
*.* @@pс2.example.com $ActionExecOnlyWhenPreviousIsSuspended on & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off 
Zhukov Roman Zhukov Roman
8,890 ten 26
|