Forwarding rsyslog messages to more than one server

Home > CentOS > CentOS 6.x > Rsyslog configuration > Forwarding rsyslog messages to more than one server

To forward rsyslog messages to more than one server use following configuration at the end of default rsyslog.conf file:

$WorkDirectory /rsyslog/work  # default location for work (spool) files

# start forwarding rule 1
$ActionQueueType LinkedList   # use asynchronous processing
$ActionQueueFileName srvrfwd1 # set file name, also enables disk mode
$ActionResumeRetryCount -1    # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.*       @server1:port
# end forwarding rule 1

# start forwarding rule 2
$ActionQueueType LinkedList   # use asynchronous processing
$ActionQueueFileName srvrfwd2 # set file name, also enables disk mode
$ActionResumeRetryCount -1    # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.*       @server2
# end forwarding rule 2

Steps learned from http://serverfault.com/questions/522341/how-do-i-setup-rsyslog-to-send-all-logs-to-multiple-remote-servers and http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html

Home > CentOS > CentOS 6.x > Rsyslog configuration > Forwarding rsyslog messages to more than one server