Hi, I'm forwarding messages over tcp to a central log server using omfwd. I've configured a queue and enabled ResendLastMSGOnReconnect - but I still *always* lose the first message when it reconnects.
I'm using the rsyslogd bundled with Ubuntu 14.04 (or 18.04) - 8.16.0 My configuration looks like this: # QUEUE messages for sending to log host $WorkDirectory /var/spool/rsyslog # Should not be needed - in main rsyslog.conf # Template RSYSLOG_SyslogProtocol23Format is the format used by RFC5424 :syslogtag, contains, "cfr" action( type="omfwd" name="centrallog" Target="logbox.local" Port="5140" Protocol="tcp" Keepalive="on" Template="RSYSLOG_SyslogProtocol23Format" ResendLastMSGOnReconnect="on" action.resumeRetryCount="-1" queue.type="LinkedList" queue.filename="centrallog" queue.saveonshutdown="on" ) Steps to reproduce: * Shut down the central log server (so it responds with "connection refused") * Send a sequence of matching messages to rsyslogd (messages are queued) * Restart the central log server * Wait Then, if I send a sequence of 4 messages, only the last 3 are delivered - the first one is silently lost. (Yes, I have read https://www.rsyslog.com/doc/v8-stable/tutorials/reliable_forwarding.html and http://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html and I understand the shortcomings of a tcp protocol which doesn't have acknowledgements) Does anyone have any ideas how I can make the log more reliable, at least, against the common case where the central server is down at the time of logging, and then later recovers (I can tolerate loss of any "in flight" messages, because they will be few). Mark _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
