[rsyslog-notify] Forum Thread: Re: Rsyslog silently discarding messages - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26840#p26840

Message: 
----------
[quote="liupjo":2mdlogkl][
The only "strange" behaviour related to rsyslog is during restart. When a
message without a newline is received by rsyslog and the daemon gets
restarted right afterwards, the message doesn't get flushed to disk (except
in the case of a full maxmessagesize) but discarded.
Is this behaviour by design or there is a way to configure rsyslogd not to
discard "partially" received messages?
[/quote:2mdlogkl]

That is by design. Those bytes have not yet become a message (they are not
in any rsyslog queue)

When rsyslog shuts down, messages 'in flight' via TCP will be lost. They
may be lost in the OS buffers on the sender, they may be lost because they
are 'on the wire' at the time of the shutdown, they may be lost because
they are in the OS buffers on the receiving system, and finally, they may
be lost if Rsyslog has read them from the OS and not yet processed them
into a message and put it in the queue.

<!-- m --><a class="postlink"
href="http://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html">http://blog.gerhards.net/2008/04/on-unr
... yslog.html</a><!-- m -->

This is why RELP was created