Hello, Yes. But 5 minutes delay is hard to explain if journald is not involved.
That's why I suggested to double check that messages are really coming from the network to rsyslogd and thereafter written to the disk by rsyslogd. Den ons 16 dec. 2020 kl 09:06 skrev Yuri Bushmelev <jay4m...@gmail.com>: > Hello! > > As I understand, the topic starter was talking about messages from the > network (I guess received on port 514/udp). There is no journald involved > in this case. > > On Wed, 16 Dec 2020 at 00:45, Vitaly Repin via rsyslog < > rsyslog@lists.adiscon.com> wrote: > >> Hello, >> >> Check which process listens to /dev/log at the destination server. It >> might >> be journald and not rsyslogd. >> >> Config file you shared does not have SystemLogSocketName. Probably it is >> somewhere in /etc/rsyslog.d/ >> This sets the name of the socket rsyslogd is listening to. >> >> Delay 2-5 minutes can be caused by journald. >> >> Den tis 15 dec. 2020 kl 16:09 skrev supertwisters via rsyslog < >> rsyslog@lists.adiscon.com>: >> >> > I'm using `rsyslog` to collect logs from multiple servers which are all >> > being >> > sent to a single server. >> > I've noticed that logs sometime appears with delay of 2-5 minutes in >> > `/var/log/messages` of the destination server. >> > >> > By using `tcpdump` on both source and destination servers, i saw that >> the >> > messages are being sent from the source server and being received in >> > destination server almost immediately. However, The messages appears >> with >> > delay in `/var/log/messages` of the destination server, and not at the >> same >> > moment as they received in the server according to `tcpdump`. >> > >> > What could be the issue? Please advise. >> > >> > Attached is my rsyslog.conf file. rsyslog.rsyslog >> > < >> http://rsyslog-users.1305293.n2.nabble.com/file/t396283/rsyslog.rsyslog> > > -- WBR & WBW, Vitaly _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
