On Wed, Jul 01, 2020 at 06:04:50PM +0000, Antonio Leding wrote:
> Thanks Wietse - rsyslog template it is then...
Bear in mind that on Linux systems with systemd-journald, even if you
ultimately forward messages to rsyslog for storage, the logging
subsystem is substantially deficient, and you SHOULD bypass it.
* With systemd-journald, log entries from multiple processes
are not always logged in order of arrival. This is because
it uses stream rather than dgram sockets, so there is no
longer a single ordered message queue.
* With systemd-journald, there are default rate limits that
are easily exceeded on busy servers and messages are lost.
* With a single-threaded systemd-journald, the log processing
is limited to a single CPU, and on a busy server, once that
process hits 100% CPU, its clients block writing messages
(stream socket) limiting overall performance.
Avoid systemd-journald, it is not a robust logging system.
--
Viktor.
