[rsyslog-notify] Forum Thread: Re: rsyslog: does rsyslog support in-oder log messages deliv - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=27211#p27211

Message: 
----------
yes, you would still be using the main queue and sharing it with other logs
if you don't define a queue on the ruleset that you tie to the port 514
input

Any input goes to the main queue by default, you have not changed that
default for that input.

I would have to do some digging to check all the defaults for the main
queue, but it's defaults are different in many ways from other queues.

In any case, you should only be seeing additional workers being spawned if
you are under very high load.

I guess I've lost the exact point of the question, are you trying to
guarantee that there will never be any reordering of logs? If so, just
define your queue and define that it will only have a max of 1 worker. If
that's not what you are asking, try restating the question.