[rsyslog] computer hang-up and WorkDirectory

[Rainer Gerhards]

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Mr. Demeanour
> Sent: Friday, November 06, 2009 8:10 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] computer hang-up and WorkDirectory
> 
> david at lang.hm wrote:
> > On Fri, 6 Nov 2009, Miguel Angel Nieto wrote:
> >
> >>> in other cases you are willing to loose logs rather than freezing
> >>> the machine and can configure rsyslog to accept messages, even
> >>> when it can't do anything with them to avoid this sort of lockup.
> >>>
> >> How can I do to tell rsyslog to accept all messages and not use any
> >> queue?
> >
> > you cannot tell rsyslog to not use a queue.
> 
> Is that really true?
> 
> "Direct queues are non-queuing queues. A queue in direct mode does
> neither queue nor buffer any of the queue elements but rather passes
> the
> element directly (and immediately) from the producer to the consumer.
> This sounds strange, but there is a good reason for this queue type."
> 
> [...]
> 
> "To create a direct queue, use the "$<object>QueueType Direct" config
> directive."
> 
> e.g. (I suppose):
> 	$MainQueueType Direct
> 
> 
> http://www.rsyslog.com/doc-queues.html

Sorry, I overlooked that message first. You are right. While rsyslog needs
queues (more precisely: queue objects), one can configure queue objects not
to queue. This is the default case for actions.

However, you most often do not want to set the main queue to direct. But you
can and there are use cases for it. The bottom line than is that sender and
action processing are tightly couple, so with inputs like UDP you will most
probably lose a lot of messages, especially when using slow backends like
databases. One cure is to run those slow backends then on async action
queues.

HTH
Rainer