问题描述

linux rsyslog 的 rsyslog.conf 配置客户端 缓存问题

现在对客户端的配置修改：

** * **# Remote Logging (we use TCP for reliable delivery)

An on-disk queue is created for this action. If the remote host is

down, messages are spooled to disk and sent when it is up again.

$WorkDirectory /rsyslog/spool # where to place spool files
$ActionQueueFileName uniqName # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown off # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously#$ActionResumeRetryCount -1 # infinite retries if host is down

remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

. @@remote-host:514** * **

######### Receiving Messages from Remote Hosts ##########

需求：我的客户端长时间与服务器断开，一般不与服务器连接的，只有在需要的时候才连接，估计是1年或者2年后，所以rsyslog 必须保存缓存。我只想保存最近的1g,或者400m什么的，在1g或者400m空间里，产生的新的覆盖旧的，最多永远是1g或者400m.这个配置好像不好弄，

尝试：
服务器断开后，能生存缓存，总共缓存可以达到1g,
但是到了1g后，就不能再缓存日志了，就是写不进去了。
请问：这段如何配置，使达到1g后，又从开始位置文件写，使缓存文件，保存最近的1g日志，新的覆盖旧的，我试了很多办法，都无效，

rsyslog.conf 配置文件内容：

if you experience problems, check

http://www.rsyslog.com/troubleshoot for assistance

rsyslog v3: load input modules

If you do not load inputs, nothing happens!

You may need to set the module load path if modules are not found.

$ModLoad immark # provides --MARK-- message capability
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)

Log all kernel messages to the console.

Logging much else clutters up the screen.

#kern.* /dev/console

Log anything (except mail) of level info or higher.

Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none -/var/log/messages

The authpriv file has restricted access.

authpriv.* /var/log/secure

Log all the mail messages in one place.

mail.* -/var/log/maillog

Log cron stuff

cron.* -/var/log/cron

Everybody gets emergency messages

*.emerg *

Save news errors of level crit and higher in a special file.

uucp,news.crit -/var/log/spooler

Save boot messages also to boot.log

local7.* /var/log/boot.log

** * **# Remote Logging (we use TCP for reliable delivery)

An on-disk queue is created for this action. If the remote host is

down, messages are spooled to disk and sent when it is up again.

$WorkDirectory /rsyslog/spool # where to place spool files
$ActionQueueFileName uniqName # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown off # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down

remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

. @@remote-host:514** * **

######### Receiving Messages from Remote Hosts ##########

TCP Syslog Server:

provides TCP syslog reception and GSS-API (if compiled to support it)

#$ModLoad imtcp.so # load module
#$InputTCPServerRun 514 # start up TCP listener at port 514

UDP Syslog Server:

#$ModLoad imudp.so # provides UDP syslog reception
#$UDPServerRun 514 # start a UDP syslog server at standard port 514