FAQ

• FAQ: some general topics often asked
  • FAQ: Message Duplication with rsyslog
• Why does a blocking action stop all log processing?
  • See Also
• What is the difference between the main_queue and a queue with a ruleset tied to an input?
  • If an input bounded ruleset does not have a queue defined, what default does it have?
  • What is the recommended way to use several inputs? Should there be a need to define a queue for the rulesets?
• FAQ: Encrypting MySQL Traffic with ommysql Plugin
  • Question
  • Answer
  • Steps to Enable TLS
  • Additional Resources
• FAQ: Troubleshooting UDP Packet Loss
  • Q1: I see packet loss in my OS statistics for imudp. What are the potential causes, troubleshooting steps, and probable fixes?
  • Q2: How can I definitively check if the OS kernel is dropping UDP packets due to full receive buffers?
  • Q3: Why does tcpdump show traffic as “ip-proto-17” without a port number?
  • Q4: My OS stats show “packets to unknown port”. How do I find out which port is being used?
  • Q5: How does rsyslog set the UDP receive buffer? Does it use SO_RCVBUFFORCE?
• Common Configuration Mistakes and Misunderstandings
• Why do I see gibberish when connecting with TLS?
  • Description
  • Detection strategy
  • Resolution
  • Notes
  • See also
• FAQ: impstats Push Mode (Remote Write)
  • Q: Do I need format="prometheus" to use push mode?
  • Q: What exactly enables push mode?
  • Q: How do I verify my build supports push mode?
  • Q: What happens when the remote endpoint is down?
  • Q: Is push asynchronous?
  • Q: How are HTTP error responses handled?
  • Q: How are metric names generated?
  • Q: Which labels are attached by default?
  • Q: How do batch limits behave?
  • Q: Do TLS parameters work with http:// URLs?
  • Q: Do push.tls.certfile and push.tls.keyfile need to be set together?
  • Q: Are there authentication parameters for HTTP Basic or Bearer token?
  • Q: Does resetCounters affect pushed values?
  • Q: How should I verify push mode quickly?
  • See also
• FAQ: Can rsyslog act as an ETL tool?
  • Why rsyslog qualifies as an ETL engine
  • High performance by design
  • Fan-out and vendor evaluations
  • Reduce noise before it reaches downstream systems
  • Getting started
  • Where to get more help
• FAQ: Sending Logs from rsyslog to Vespa.ai
  • How do I send rsyslog messages to Vespa.ai?
  • Why is this integration useful?
  • Tips for production use
• Does rsyslog run under Windows?
  • Alternatives
  • Summary

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.