Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

On Tue, 13 Feb 2024, Prasad Koya via rsyslog wrote: While these messages are deep copied and enqueued to respective action queues, it's possible that the second message may reach the remote syslog server before the first message. I'd like to avoid that situation. How do I define one queue for

Re: [rsyslog] Cant parse incoming json via relp

what is the config of the receiver? I'll note that what you are sending is valid json, but not a valid syslog message, that could be why you are running into grief. log using the template RSYSLOG_DebugFormat on the receiver so we can see exactly what it's getting. Also, you have a comment

Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

Thanks for replying. The problem I'm trying to solve is when forwarding syslogs to multiple servers over TCP. Yes, UDP is unreliable and out of order messages are expected. I'm understanding more about rulesets. I'll get back to the thread after some more work on this. On Wed, Feb 14, 2024 at

[rsyslog] Cant parse incoming json via relp

Hello I have two rsyslog servers - sender and receiver Sender get data, convert it to json and send via relp to receiver But receiver can't parse json 1. Sender config module(load="omrelp") template( name="json_syslog" type="list" option.json="on" ) { constant(value="{")

Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

> You could try pushing all events to a single ruleset with a queue with > just one worker thread. I suppose then the events dequeued from the main > queue and enqueued into the ruleset queue would be in order. I'm not > fully sure about the order of events enqueued into action queues though. >