[rsyslog-notify] Forum Thread: Re: Rsyslog logging using variables - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25944#p25944

Message: 
----------
define a disk assist for the main queue (in the queue() statement)

however, even with disk assisted queues and a setting to write the queues
to disk on a clean shutdown, there are a lot of scenarios where you don't
have the clean shutdown (power failures, system crashes, OOM events,
rsyslog crashes, etc) that you are still not 100% guranteeing the log
reliability.

It is possible to do so, (disk-only queues, syncing to disk after every
step, etc) but the throughput of rsyslog drops by 1000x -100,000x
(depending on what filesystem/disk you have in use) and you run into the
problem that a slowdown/outage of your logging will slow/stop your
production systems, along with cases where system failures can strand logs
on a machine.

you are almost never in a situation where log reliability is the top
priority, even for security and audit logs.

In any case, putting a queue on every action does not increase the
reliability/resiliance of the log message.

So let's first work on getting the logs working and then talk about
reliability.