Another option could be to use imjournal. One of its benefits are that you get early boot messages and late shutdown messages directly from the journal.
Am Mi., 11. Sept. 2024 um 02:21 Uhr schrieb John Chivian via rsyslog <rsyslog@lists.adiscon.com>: > > You can solve this with two instances of rsyslog. > > The first instance does all the system local stuff writing to local log > files, and does not require the “after=networking.service”. > > The second instance reads all those files delivering the content to the > network destination (with queuing as David recommended) and would benefit > from the “after=networking.service”. > > It’s an admitted kludge, but your local log files won’t suffer the same > degree of event loss. > > Regards, > > > > > On Sep 10, 2024, at 18:49, Andy Smith via rsyslog > > <rsyslog@lists.adiscon.com> wrote: > > > > On Tue, Sep 10, 2024 at 11:26:03PM +0000, Andy Smith via rsyslog wrote: > >> It's not quite ideal however because the *local* log files are then > >> missing entries from the entire time the network is down, which can > >> be quite significant. For example here is the final line before > >> shutdown and first line after next boot on a simple reboot: > >> > >> 2024-09-10T22:53:31.059980+00:00 hib systemd[1]: Stopped target Multi-User > >> System. > >> 2024-09-10T22:57:03.345006+00:00 hib systemd[1]: systemd-fsckd.service: > >> Succeeded. > > > > Actually that was nonsense; I was reading that from the remote > > syslog so obviously those entries were missing. > > > > Now I'm correctly reading the local log files I see that on boot, > > rsyslogd does start after networking as instructed and then gets all > > the prior logging from systemd's journal, so local log files do seem > > to be more complete. > > > > The situation on shutdown is not ideal still though, due to > > rsyslogd having to be shut down so soon. > > > > Thanks, > > Andy > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
