rsyslog

The rocket-fast system for log processing

What is the difference between the main_queue and a queue with a ruleset tied to an input?

A queue on a ruleset tied to an input replaces the main queue for that input. The only difference is the higher default size of the main queue.

If an input bounded ruleset does not have a queue defined, what default does it have?

Rulesets without a queue on them use the main queue as a default.