Ok, I solved it. It appears that there was a bug in Rsyslogd 8.16.0 (at least in Ubuntu's version) which causes it to ignore ResendLastMSGOnReconnect.
This is fixed in the official repository 8.34.0. Using an identical configuration, my system now works as expected. Mark -----Original Message----- From: rsyslog [mailto:[email protected]] On Behalf Of Mark Robson via rsyslog Sent: 05 April 2018 15:38 To: [email protected] Cc: Mark Robson Subject: [rsyslog] omfwd: First message is lost after log server recovers Hi, I'm forwarding messages over tcp to a central log server using omfwd. I've configured a queue and enabled ResendLastMSGOnReconnect - but I still *always* lose the first message when it reconnects. I'm using the rsyslogd bundled with Ubuntu 14.04 (or 18.04) - 8.16.0 My configuration looks like this: # QUEUE messages for sending to log host $WorkDirectory /var/spool/rsyslog # Should not be needed - in main rsyslog.conf # Template RSYSLOG_SyslogProtocol23Format is the format used by RFC5424 :syslogtag, contains, "cfr" action( type="omfwd" name="centrallog" Target="logbox.local" Port="5140" Protocol="tcp" Keepalive="on" Template="RSYSLOG_SyslogProtocol23Format" ResendLastMSGOnReconnect="on" action.resumeRetryCount="-1" queue.type="LinkedList" queue.filename="centrallog" queue.saveonshutdown="on" ) Steps to reproduce: * Shut down the central log server (so it responds with "connection refused") * Send a sequence of matching messages to rsyslogd (messages are queued) * Restart the central log server * Wait Then, if I send a sequence of 4 messages, only the last 3 are delivered - the first one is silently lost. (Yes, I have read https://www.rsyslog.com/doc/v8-stable/tutorials/reliable_forwarding.html and http://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html and I understand the shortcomings of a tcp protocol which doesn't have acknowledgements) Does anyone have any ideas how I can make the log more reliable, at least, against the common case where the central server is down at the time of logging, and then later recovers (I can tolerate loss of any "in flight" messages, because they will be few). Mark _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
