[rsyslog-notify] Forum Thread: Re: Rsyslog queues and performance impacts - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24883#p24883

Message: 
----------
Issues come in bursts :-)

I did this writeup a couple days ago <!-- l --><a class="postlink-local"
href="http://kb.monitorware.com/postfix-reliable-setup-t12404.html#p24866">postfix-reliable-setup-t12404.html#p24866</a><!--
l -->

to answer your questions

A. if you are using direct, there is no action queue, so when a message
can't be delivered (remotely or locally), all processing basically stalls.
If the connectivity is intermittent, data may get through in bursts.

B. If disk size is unlimited, the total queue size is whatever will fill
your disk.

C. I believe it applies to all messages in the queue, but Rainer would need
to comment to confirm this.

It's usually a good idea to setup an action queue for any actions that will
block if the network is not working (TCP, RELP, database, etc) because that
is a common type of failure, and you really want the rest of the logs to
continue to be written locally so that you can figure out what's happening.

$ActionQueueType Direct is the default

What version of rsyslog are you using?

working with queues with the legacy config language can get _very_
confusing, it's much clearer what's happening with the queue with the new
config language (in addition to all the other advantages of running a
current version)

read my post above and you will probably have more questions.