[rsyslog-notify] Forum Thread: Re: rsyslog: does rsyslog support in-oder log messages deliv - (Mode 'edit_last_post')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26246#p26246

Message: 
----------
as soon as you have any parallel processing (multiple threads, failover
machines, multiple network connectons, etc) you have no real ability to
keep everything exactly in order. The best you could possibly do is tag
each message with a sequence number early on and sort them later (but even
there, how do you order things that arrive via different inputs at the same
time)

Even the simplest traditional syslog could end up with logs re-ordered due
to different UDP packets taking different paths through the network.

Trying to keep things in order requires global locks, one thread waiting
for another that may not finish because it's trying to deliver to a
destination that's down, etc.

So we decided to focus on speed, because if you are fast enough, you can
use a single thread instead of multiple threads for the same throughput,
and the logs will be more in order (even though you aren't guaranteeing
that they will be in order). It's under very high load or failure
conditions that rsyslog will end up getting them out of order. Spilling to
disk and then sending the old logs is one of the more common failure
conditions, and I think it's unfortunate that it turns out to be so much
more efficient to keep sending the newest logs and send the old logs as you
can, but that is the case.