[rsyslog-notify] Forum Thread: Re: rsyslog: does rsyslog support in-oder log messages deliv - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=27207#p27207

Message: 
----------
Inside rsyslog, there are a couple of things that can cause messages to be
processed out of order

1. if you have disk-assisted queues and the memory queue overflows and
messages get written to disk, rsyslog will process new messages all in
memory and the messages that got written to disk will end up out of order.

2. if you have multiple worker threads, each worker will grab up to
batchsize messages and process all of those messages before grabbing
another batch. This means that worker 1 may grab messages 1-100 while
worker 2 grabs messages 101-200, assuming equal processing speed, that
means that these two batches will end up intermingled

3. if you are using imfile, rsyslog will read a batch of messages from each
file in round-robin fashion, this will keep the messages from each file in
the same order, but if you are looking at timestamps and don't realize they
have different source files, it will look like they are being reordered.

does this clarify things?