Issue

In a client and server rsyslog environment configured as follows:

• Multiple rulesets defined on the client rsyslog
• Local on disk queues configured on the client rsyslog instance (see solution)
• One or more remote rsyslog configured as central logging servers

When the remote rsyslog server is not available, the rsyslog client will eventually start spooling some messages on disk. Now if this client rsyslog service gets restarted and later the remote rsyslog server is available again, the queued messages will not make it to the remote server. The rsyslog spool directory will contain a number of files containing the queued messages but none of these will ever be sent to the remote counterpart.