#1912 Update Rsyslog.conf file
Merged a month ago by kevin. Opened a month ago by aheath1992.
Unknown source main  into  main

Update Rsyslog.conf file
Andrew Heath • a month ago  
@@ -161,21 +161,21 @@

  #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#

  

   $DefaultNetstreamDriverCAFile /etc/pki/tls/certs/2022-IT-Root-CA.pem

- # *.* action(

- #     type="omfwd"

- #     target="10.31.20.29"

- #     port="6514"

- #     protocol="tcp"

- #     queue.filename="fwdRule1"       # unique name prefix for spool files

- #     queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)

- #     queue.saveonshutdown="on"       # save messages to disk on shutdown

- #     queue.type="LinkedList"         # run asynchronously

- #     queue.size="500000"

- #     action.resumeRetryCount="10"    # 10 retries if host is down

- #     StreamDriver="gtls"

- #     StreamDriverMode="1"

- #     StreamDriverAuthMode="anon"     # not authenticated

- # )

+  *.* action(

+      type="omfwd"

+      target="10.23.176.84"

+      port="6514"

+      protocol="tcp"

+      queue.filename="fwdRule1"       # unique name prefix for spool files

+      queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)

+      queue.saveonshutdown="on"       # save messages to disk on shutdown

+      queue.type="LinkedList"         # run asynchronously

+      queue.size="500000"

+      action.resumeRetryCount="10"    # 10 retries if host is down

+      StreamDriver="gtls"

+      StreamDriverMode="1"

+      StreamDriverAuthMode="anon"     # not authenticated

+  )

  

  

  

Update Rsyslog config file to use the Splunk LB for rsyslog rather than
one single host.

Looks reasonable to me. +1

(will need one more +1 since we are in freeze)

so this is a follow-up to 6f949fe ? are we confident it will avoid the problem that was working around?

Yeah, it was tested before the freeze, but never committed, so when I ran playbooks the other day it pushed back the disabled config.

This is just re-enabling it as it was working before last week.

rebased onto 74e536d

a month ago

Pull-Request has been merged by kevin

a month ago