rsyslog to resend event from client after abnormal server crash
Rsyslog Server IP: 192.168.122.94
Rsyslog Client IP: 192.168.122.93
1) Done rsyslog server force reboot
root@rsyslogser
Write failed: Broken pipe
2) After reboot I have sent an event from rsyslog client.
3) Server is running on port 1014 and client is configured to forward logs to server on 1014
3) Ran tcpdump on rsyslog server to listen the communication on port 1014. For the first time when we send event after force reboot, rsyslog client is not able to forward event to rsyslog server. Then after, rsyslog client is able to forward logs to rsyslog server.
root@rsyslogser
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
11:03:05.687971 IP 192.168.122.94.1014 > 192.168.
11:05:28.096264 IP 192.168.122.94.1014 > 192.168.
11:05:28.096605 IP 192.168.122.94.1014 > 192.168.
Reason: This seems general behavior of any TCP connection. If any System crashes or terminates abnormally and after that if we send any TCP request then it resets old pre-cash connection and establishes new connection. This will not happen for normal reboot.
RefLink: https:/
But here my question is how to prevent loss of that event for the first time. Will there be any configurations in rsyslog server/client side to prevent event loss.
Question information
- Language:
- English Edit question
- Status:
- Expired
- For:
- Ubuntu rsyslog Edit question
- Assignee:
- No assignee Edit question
- Last query:
- Last reply: