On Tue, 20 Dec 2016, [email protected] wrote:
On 12/20/2016 1:38 AM, Benoit DOLEZ wrote:
Hi,
The ~40 messages are those of the window size : for performance reason, a
train of messages are sent and acked globally. To ack each message
independently you can try windowsize=1 with omrelp, but sending message
synchronously is a very bad idea. For omfwd, a tcp window size is applied.
With UDP, there is no ack, no window.
Regards
Benoit
Thanks for the reply. Am I correct in assuming then that I can expect
duplicate messages each time I restart the remote rsyslog receiver instance?
If you are using RELP, any messages that the sender has not received a
confirmation of recipt for will be re-sent.
If you are using plain TCP, messages in flight will be lost
If you happened to have looked over the configs, did you see anything that
would result in the sending systems tossing old messages if the remote
rsyslog receiver stays down longer than "X" seconds?
Rsyslog has nothing that will throw away messages based on time. You can set it
to throw away messages if the queues get too full (look at the high watermark
settings)
you can also set the retries so that it will only attempt to deliver a message X
times before it gives up on that message.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
