You can solve this with two instances of rsyslog. The first instance does all the system local stuff writing to local log files, and does not require the “after=networking.service”.
The second instance reads all those files delivering the content to the network destination (with queuing as David recommended) and would benefit from the “after=networking.service”. It’s an admitted kludge, but your local log files won’t suffer the same degree of event loss. Regards, > On Sep 10, 2024, at 18:49, Andy Smith via rsyslog <rsyslog@lists.adiscon.com> > wrote: > > On Tue, Sep 10, 2024 at 11:26:03PM +0000, Andy Smith via rsyslog wrote: >> It's not quite ideal however because the *local* log files are then >> missing entries from the entire time the network is down, which can >> be quite significant. For example here is the final line before >> shutdown and first line after next boot on a simple reboot: >> >> 2024-09-10T22:53:31.059980+00:00 hib systemd[1]: Stopped target Multi-User >> System. >> 2024-09-10T22:57:03.345006+00:00 hib systemd[1]: systemd-fsckd.service: >> Succeeded. > > Actually that was nonsense; I was reading that from the remote > syslog so obviously those entries were missing. > > Now I'm correctly reading the local log files I see that on boot, > rsyslogd does start after networking as instructed and then gets all > the prior logging from systemd's journal, so local log files do seem > to be more complete. > > The situation on shutdown is not ideal still though, due to > rsyslogd having to be shut down so soon. > > Thanks, > Andy > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
