I can suggest a few things to work this around. At first you should clearly understand log messages can (and will) be lost. It's ok. rsyslog (and any log collector) is not a database.
Then I guess you're using UDP on localhost to deliver messages from your application to the rsyslog daemon. I see 2 solutions there. 1. Switch to datagram unix socket. It'll block on write though so you should adopt your application. But if the DGRAM socket is created by systemd e.g. then OS will be able to hold a few DGRAM packets in the OS queue during rsyslog daemon restart. 2. Use 2 rsyslog daemons running on localhost. First one is just to accept messages on a UDP port and deliver them to another rsyslog instance via TCP or RELP with a queue attached. Second rsyslog instance will do complex things. So in most cases you will change 2nd instance configuration changes. As you have a queue on 1st instance output you can restart 2nd instance w/o losing messages here. I'd even suggest you use the distro-bundled rsyslog version as 1st instance and the latest rsyslog version in a container as 2nd instance. On Tue, 5 Jan 2021 at 15:41, Shirisha Dasari via rsyslog < rsyslog@lists.adiscon.com> wrote: > Thanks David for the response. Our use-case involves imudp (UDP reception > of > syslog messages), imuxsock and imklog. The major config changes expected > are > w.r.t remote server logging details. > > We are evaluating if there is any way to alleviate the possible loss of > messages when rsyslog is restarted due to a change in the configuration > file. We were evaluating if there is a chance of keeping the input modules > running to avoid this loss while parts of rsyslog may restart due to a new > configuration. I understand this in itself may be a herculean task > considering the interdependencies and config being tied together. > > Could you please provide inputs on the above approach? Also, it looks like > there was a text API based interface you had proposed to allow some basic > runtime-config changes to rsyslog > ( > http://rsyslog-users.1305293.n2.nabble.com/making-config-changes-to-a-running-rsyslog-td7591667.html). > > Could you please elaborate on the same as well? > > > > -- > Sent from: http://rsyslog-users.1305293.n2.nabble.com/ > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- Yury Bushmelev _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
