25.5.4. Using the New Syntax for rsyslog queues

In the new syntax available in rsyslog 7, queues are defined inside the action() object that can be used both separately or inside a ruleset in /etc/rsyslog.conf. The format of an action queue is as follows:

action(type="action_type" queue.size="queue_size" queue.type="queue_type" queue.filename="file_name")

Replace action_type with the name of the module that is to perform the action and replace queue_size with a maximum number of messages the queue can contain. For queue_type, choose disk or select from one of the in-memory queues: direct, linkedlist or fixedarray. For file_name specify only a file name, not a path. Note that if creating a new directory to hold log files, the SELinux context must be set. See Section 25.5.2, “Creating a New Directory for rsyslog Log Files” for an example.

action(type="omfile" queue.size="10000" queue.type="linkedlist" queue.filename="logfile")

The rsyslog 7 syntax for a direct action queues is as follows:

*.* action(type="omfile" file="/var/lib/rsyslog/log_file
     )

The rsyslog 7 syntax for an action queue with multiple parameters can be written as follows:

*.* action(type="omfile"
              queue.filename="log_file"
              queue.type="linkedlist"
              queue.size="10000"
     )

The default work directory, or the last work directory to be set, will be used. If required to use a different work directory, add a line as follows before the action queue:

global(workDirectory="/directory")

*.* action(type="omfwd"
      queue.type="linkedlist"
      queue.filename="example_fwd"
      action.resumeRetryCount="-1"
      queue.saveOnShutdown="on"
      target="example.com" port="6514" protocol="tcp"
     )