1

As per the answers here and here, restarting rsyslog is the correct way to do a config reload. But logs which rsyslog may have been processing at the time may be lost.

Is there a way to avoid this by having rsyslog temporarily store the logs in a file before going down (since we expect a graceful restart) and then read those first as soon as it comes back up again ? When systemd is used, this will help because any new logs will be buffered in the activated socket and can be read after rsyslog finishes reading the temporary log file.

meuh
  • 1,563
  • 10
  • 11
Jayanth
  • 11
  • 2
  • *When systemd is used* Be careful if you expect `systemd` to ensure that every log entry is written to disk. In my experience, even if you try to completely disable log throttling, at some point `systemd` decides to drop log entries anyway. And then `systemd` effectively never logs anything from that application until the system is rebooted. – Andrew Henle Feb 15 '21 at 23:38
  • In our case, rsyslog consumes log messages from systemd-journal via imuxsock. Nobody logs directly to rsyslog. Rsyslog's purpose is to send these messages to a remote syslog server. What I meant in my question was that when rsyslog goes down for a restart, the new messages from journal will still be buffered in the activated /run/systemd/journal/syslog socket even if rsyslog takes time to come up and start reading them. – Jayanth Feb 16 '21 at 06:53
  • @Jayanth Did you find a solution? – Markus Bruckner Jun 07 '21 at 07:40
  • 1
    @MarkusBruckner, nope. The maintainers admit logs will be lost on restart as per this open issue: https://github.com/rsyslog/rsyslog/issues/3759 – Jayanth Jun 07 '21 at 10:14

0 Answers0