[rsyslog-notify] Forum Thread: Re: Syslog gnutls malfunction - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25229#p25229

Message: 
----------
This is normal behavior, syslog processes messages one at a time and if one
output is blocked it will wait and retry before delivering the next message

Rsyslog offers the option of creating an additional queue for an output
(lookup action queues) so that instead of blocking on an output, it will
queue the messages for that output. when that queue fills up, you get back
into the problem that you are seeing.

Queues can be 'disk assisted', which means that when the memory for a queue
fills up, additional messages get saved on disk (but if the allocated disk
space fills up, you are back to the same problem)

And finally, you can configure high and low watermark levels and configure
rsyslog so that when a queue fills above the high watermark level, it
starts discarding some of the messages (you configure what severity to
discard) until it drops below the low watermark level.

When you start configuring queues, you really want to be able to use the
new config syntax that was introduced in v6, so it's a _really_ good idea
to upgrade to a more current version of rsyslog (the currently supported
version is v8.7 to give you an idea of how out of date 5.8 is)