Topic: rsyslog

• Forwarding syslog with rsyslog over TCP behind a disk-assisted queue

  A drop-in file under /etc/rsyslog.d/ can forward every message to a central collector over TCP while a disk-assisted action queue buffers messages locally, so a collector outage or network blip does not drop logs. rsyslogd -N1 validates the syntax before the change is applied.

  methodology · en · reviewed · knowledge as of 2026-09-24

• TLS for rsyslog forwarding with the gtls driver, and when RELP is worth adding

  rsyslog's gtls network stream driver encrypts and can mutually authenticate a forwarding connection with X.509 certificates, configured with StreamDriverAuthMode. Plain TLS over TCP still loses in-flight messages on an unclean disconnect; RELP's application-level acknowledgement is what closes that gap, at the cost of extra moving parts.

  article · en · reviewed · knowledge as of 2026-09-24

Machine-readable: JSON