This page talks about docker, as this is the platform the rsyslog team has hands-on experience with. Some or all of the information might also apply to other solutions.
Potential Trouble causes:
container terminate timeout
By default, a docker container has 10 seconds to shut down. If rsyslog is running with a large queue that needs to be persisted to disk, that amount of time might be insufficient. This can lead to a hard kill of rsyslog and potentially cause queue corruption.
shared work directories
Shared work directories call for problems and shall be avoided. If multiple instances use the same work directory, the may even overwrite some files, resulting in a total mess. Each container instance should have its own work directory.
If you would like to contribute to these docs, but are unsure where to start, please see the rsyslog-doc project README for an overview of the process. If you would like to contribute to the main source project, please review the contribution guidelines listed in the rsyslog project README.
If you have a question about these docs or
Rsyslog in general, please
see the following resources: