Event stream control using rsyslog

To enable rsyslog event stream control on the event source server:

1. Create two or more identical collectors that you want to use to ensure uninterrupted reception of events.
2. Install rsyslog on the event source server (see the rsyslog documentation).
3. Add rules for forwarding the event stream between collectors to the configuration file /etc/rsyslog.conf:

   *. * @@ <main collector server FQDN>: <port for incoming events> $ActionExecOnlyWhenPreviousIsSuspended on *. * @@ <backup collector server FQDN>: <port for incoming events> $ActionExecOnlyWhenPreviousIsSuspended off

   Example configuration file

   Example configuration file specifying one primary and two backup collectors. The collectors are configured to receive events on TCP port 5140.

   *.* @@kuma-collector-01.example.com:5140 $ActionExecOnlyWhenPreviousIsSuspended on & @@kuma-collector-02.example.com:5140 & @@kuma-collector-03.example.com:5140 $ActionExecOnlyWhenPreviousIsSuspended off

4. Restart rsyslog by running the following command:

   systemctl restart rsyslog.

Event stream control is now enabled on the event source server.