[rsyslog-notify] Forum Thread: Ruleset queue and action queue - (Mode 'post')

[noreply at adiscon.com]

User: ggvishnu29 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=27171#p27171

Message: 
----------
Hello, 

I am using rsyslog for log aggregation. I have few questions to ask
regarding the same. My current rsyslog config looks like this:

imfile -> my ruleset queue -> action queue -> omkafka

I am trying to achieve the following. When there are any errors in omkafka
(kafka related errors), the imfile module should be pushed back and it
should never read new log messages from the file until the messages can be
sent to kafka. I configured disk assisted queues for both ruleset and
action (omkafka). But, I still see that the messages are missing in kafka
for the time when kafka is not reachable or some other kafka related
errors. That means, somewhere in the rsyslog pipeline, messages are
dropped. I do understand the need for ruleset queue but I do not understand
how ruleset queue and action queue work together. As per <!-- m --><a
class="postlink"
href="http://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html">http://www.rsyslog.com/doc/master/raine
... eters.html</a><!-- m -->, the imfile input is a delayable input and
will be pushed back if there are any errors in the output module. But, I do
not see this happening.

Can you please clarify and tell me if I am missing something? Thanks.