There is also one additional caveat. Just because the delivery is
reliable at particular stage of transport, doesn't mean that the whole
path is guaranteed.
Let's consider a situation
source -> syslog -> rsyslog collector -> RELP -> rsyslog forwarder ->
RELP -> central rsyslog log gatherer
The initial syslog deliver is of course not reliable at all but we all
know it. But even though we employ RELP between each pair of rsyslog
components even if we have resilient queues, just because the forwarder
ACK-ed the delivery from the collector, it doesn't mean that the event
has been delivered to the central gatherer. In fact it could have been
queued on the forwarder, then the system might have crashed and the
filesystem could have been lost. So this "reliability" is highly
dependent on your definition, your needs and the money you're willing to
spend to assure it ;-)
On 17.12.2021 17:45, David Lang via rsyslog wrote:
there is no content in your message that I can see.
garanteed delivery can be a tricky thing, in part it depends on your
definition of guaranteed.
rsyslog uses queues in ram by default, so if a system crashes, the
contents of those queues are lost. Assuming you aren't talking about
that and are instead talking about the normal case of being resiliant
in the face of network problems, rsyslog has RELP available (reliable
event logging protocol). This does application layer acks so the
message is close to guaranteed (there is one known failure condition,
but so far nobody has cared about it enough to contribute or sponsor a
fix for it)
both normal TCP and UDP log delivery have failure modes that can cause
substantial message loss.
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
