Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

On Tue, 13 Feb 2024, Prasad Koya via rsyslog wrote: While these messages are deep copied and enqueued to respective action queues, it's possible that the second message may reach the remote syslog server before the first message. I'd like to avoid that situation. How do I define one queue for

Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

Thanks for replying. The problem I'm trying to solve is when forwarding syslogs to multiple servers over TCP. Yes, UDP is unreliable and out of order messages are expected. I'm understanding more about rulesets. I'll get back to the thread after some more work on this. On Wed, Feb 14, 2024 at

Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

> You could try pushing all events to a single ruleset with a queue with > just one worker thread. I suppose then the events dequeued from the main > queue and enqueued into the ruleset queue would be in order. I'm not > fully sure about the order of events enqueued into action queues though. >

Re: [rsyslog] bind one queue to a ruleset for all syslogs going to one server.

There is no guarantee either in the syslog itself that the delivery of the events will be in the order they were sent. Especially if you're using UDP. Also - I don't think there is any guarantee for two queues to be processed "in parallel". Regardless of whether you have rsyslog or anything

[rsyslog] bind one queue to a ruleset for all syslogs going to one server.

Hi Before I explain what I'm trying to solve, here is our rsyslog.conf: module( load="imuxsock" ) module( load="imklog" ) module( load="impstats" interval="60" severity="7" log.syslog="off" log.file="/var/log/rsyslog_stats") $MainMsgQueueTimeoutEnqueue 0 template( name="Msg_ForwardFormat_info"