[rsyslog] actionqueue in front of tcp forward

Gerrard Geldenhuis Gerrard.Geldenhuis at datacash.com
Thu Mar 13 10:04:11 CET 2008

> I had a somewhat sleepless night, which is good news because it
> results in good ideas ;) This problem really bugged me, but I finally
> made up my mind. Instead of wasting time on fixing broken plain tcp
> syslog transport mode (e.g. by implementing half-duplex, which isn't
> standard anyhow), I'll do "the right thing". I thought rfc 3195 is the
> right thing. But it carries a lot of overhead that I really don't
> And, most importantly, any standard additions takes ages to go through
> the IETF (I know what I am talking about, have finally succeeded to
> a better syslog rfc though it in "just" 4 (or 5?) years -- and it is
> still waiting to be published...).
> So instead of adding on any of these existing protocols, I'll do a
> lightweight but capable protocol specifically designed to solve the
> shortcomings we currently experience. Please welcome RELP, the
> event logging protocol" (name based on the quite successful selp
> event logging protocol] effort:
> http://www.monitorware.com/en/workinprogress/selp.txt).
> Relp will evolve over time. I hope to do something useful relatively
> soon, and it will be extended as the project progresses. The ultimate
> goal is to have a good, very reliable, protocol for rsyslog-to-rsyslog
> communications. I'll don't care about the outside world, so I can do
> best of breed solution. For the rest of the world, rsyslog will of
> course continue to support plain tcp syslog and will get better
> for rfc 3195. But if you wanna go hardcore on high-reliability,
> high-performance event logging, relp will be your choice.

Maybe in another 5 years RELP will replace rfc 3195 especially. Now that
rsyslog is part of official redhat release it should gain a lot of
momentum, the anouncement for RHEL5.2 beta contained rsyslog. 


More information about the rsyslog mailing list