[rsyslog-notify] Forum Thread: Re: Rsyslog queues and performance impacts - (Mode 'reply')

[noreply at adiscon.com]

User: righdforsa 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24885#p24885

Message: 
----------
dlang,

Thanks, that was great additional detail. That certainly gets me closer to
understanding what was going on in our network. I have two follow-up
questions for you:

1. In your description of TCP logging, you state:
[quote:heoyrjir]When you send a message via TCP, the sender considers it
sent when it's handed to the OS to send it.[/quote:heoyrjir]
However, this contradicts with the statement that 
[quote:heoyrjir]if you are using direct, there is no action queue, so when
a message can't be delivered (remotely or locally), all processing
basically stalls. If the connectivity is intermittent, data may get through
in bursts.[/quote:heoyrjir]
Can you clarify which of these is correct, or how they could both be true?

2. Are all 3 statements at the bottom of my config "equal" actions on my
default action queue?
[code:heoyrjir]
# Log locally.
authpriv.*                  /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog

# Send all components to remote log servers
*.* @@<server 1 IP>
& @@<server 2 IP>
[/code:heoyrjir]
That is to say, I should not expect local logging if one of the remote
servers is down? With no changes, will rsyslog still send to "server 2" if
"server 1" is not responding?