Thanks for replying. The problem I'm trying to solve is when forwarding syslogs to multiple servers over TCP. Yes, UDP is unreliable and out of order messages are expected.
I'm understanding more about rulesets. I'll get back to the thread after some more work on this. On Wed, Feb 14, 2024 at 12:50 AM Rainer Gerhards via rsyslog < rsyslog@lists.adiscon.com> wrote: > > You could try pushing all events to a single ruleset with a queue with > > just one worker thread. I suppose then the events dequeued from the main > > queue and enqueued into the ruleset queue would be in order. I'm not > > fully sure about the order of events enqueued into action queues though. > > I'm curious myself. > > In this case, it still depends on the main queue actions and settings. > To be pretty sure, it is best to bind the input directly to the > ruleset you mention. The only problem that can occur is outages of the > receiving server. During recovery, some messages may be requeued, and > this at a different queue position. > > I have seen some extreme cases of "I always need to preserve > sequence". You can ensure this via > > Bind input to a ruleset with a DIRECT mode queue, do not use any other > queue definitions in that ruleset, set potentially failing actions to > retry eternally. > > Obviously, this will deliver pretty bad performance. > > Rainer > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
