[rsyslog] actionqueue in front of tcp forward

[Johnny Tan]

Rainer Gerhards wrote:
> I have the strong feeling that it is time to do something against this
> plain old ack-less syslog tcp protocol... Maybe I add a half-duplex mode
> for starters. That's low, but quick to implement and ultra-reliable.
> I'll also see that I get more serious with RFC 3195 re-enabling. I've
> already done some basic thinking in regard to 3195 and the new syslog
> engine and doing it ultra-reliable will require a little bit of work. So
> there won't be an immediate cure - but defenitely the right route to
> take.
> 
> How about half-duplex mode? Would that work for you? It means that each
> message must be acked before the next one is sent, so tcp's streaming
> features will almost be disabled. I'd expect a drop to at most 50% (more
> probable 40%) of the performance compared to what we currently run
> (half-duplex would obviously need to be an option...). So it would be a
> large performance hit.

Just curious: do either of the above solutions (3195 and 
half-duplex) resolve the issue of losing all messages when 
the server goes down and you are going over stunnel?

It sounds like the half-duplex does, I don't know enough 
about the 3195 to know.


In answer to your question, I probably don't have as heavy a 
load as some folks out there, so it's easy for me to say, 
yes, half-duplex works for me, at least for the moment.


>> I can do without the stunnel for now.
> 
> For encryption, you could also look into the GSSAPI modules. It's
> contributed code, and I currently unfortunately have limited insight
> into it. But varmojfekoj, the contributor, has done a great job.

Thanks! I'll have to look more closely at this in a staging 
environment down the road, as I can't afford potentially 
running into another stumbling block at the moment.


> A side-note: we are rewriting phpLogCon, the web interface to syslog
> data. Any chance you happen to have some interest in that? ;)

It'll be a couple weeks before I really start looking into 
this, but yes, I was in fact planning to setup phpLogCon, too.

johnn