[rsyslog-notify] Forum Thread: Re: rsyslog: does rsyslog support in-oder log messages deliv - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26246#p26246

Message: 
----------
as soon as you have any parallel processing (multiple threads, failover
machines, multiple network connectons, etc) you have no real ability to
keep everything exactly in order. The best you could possibly do is tag
each message with a sequence number early on and sort them later (but even
there, how do you order things that arrive via different inputs at the same
time)

Even the simplest traditional syslog could end up with logs re-ordered due
to different UDP packets taking different paths through the network.

Trying to keep things in order requires global locks, one thread waiting
for another that may not finish because it's trying to deliver to a
destination that's down, etc.

So we decided to focus on peed, because if you are fast enough, you can use
a single thread instead of multiple threads for the same throughput, and
the logs will be more in order (even though you aren't guaranteeing that
they will be in order). It's under very high load or failure conditions
that rsyslog will end up getting them out of order. Spilling to disk and
then sending the old logs is one of the more common failure conditions, and
I think it's unfortunate that it turns out to be so much more efficient to
keep sending the newest logs and send the old logs as you can, but that is
the case.