Configure rsyslog to fallback to local logging

I have rsyslog setup to log to a central server over TCP. I'd prefer for it to log locally if the network or remote server is not available, but otherwise omit local logs. It's straight forward to log to both but I haven't seen a way to log to either/or.


This rsyslog tutorial shows how you can have several sequential actions, but make each apply only if the previous one failed by using the special action parameter execOnlyWhenPreviousIsSuspended. The action parameters are described here. This short example shows how, if the remote tcp server stops accepting messages, they can be saved to a local file instead.

action(type="omfwd" target="primary.example.com" port="10514"
       protocol="tcp")
action(type="omfile" tag="failover" file="/var/log/localbuffer"
       action.execOnlyWhenPreviousIsSuspended="on")

As an alternative, you can configure a disk queue for a destination, to hold on to messages locally until the remote becomes available again, when they will be sent on.