Concepts

Explains rsyslog’s core architectural concepts — from the log pipeline (inputs → rulesets → actions) and its supporting queues, to components like the janitor, message parser, and network stream drivers.

Overview

This chapter describes the core building blocks of rsyslog — the objects and mechanisms that make up its architecture. These topics are useful when you want to understand how rsyslog processes events internally, how queues and workers interact, or how different rulesets isolate workloads.

Each concept page provides a focused explanation and points to configuration options that control the behavior of that subsystem.

Note

The pages in this chapter are primarily conceptual. For configuration syntax and examples, see the corresponding pages under Configuration.

Core concepts

Below is an overview of the conceptual topics included in this chapter.

• The Log Pipeline
  • Why this matters
  • Subpages
• Understanding rsyslog Queues
  • Where are Queues Used?
  • Queue Modes
  • Limiting the Queue Size
  • Worker Thread Pools
  • Filled-Up Queues
• The Janitor Process
• Message parsers in rsyslog
  • Intro
  • What are message parsers?
  • How are message parsers used?
  • Which message parsers are available
  • Conclusion
• Multiple Rulesets in rsyslog
  • What is a Ruleset?
  • What does “To bind to a Ruleset” mean?
  • Why are rulesets important for different parser configurations?
  • Can I use a different Ruleset as the default?
  • Rulesets and Queues
  • Examples
  • Performance
• NetStream Drivers
  • Current Network Stream Drivers

How to use this section

• Start with The Log Pipeline to learn how rsyslog structures its event flow — this is the foundation for all other components.

• Continue with Understanding rsyslog Queues to understand how rsyslog handles buffering, reliability, and concurrency between pipeline stages.

• Review Message parsers in rsyslog for insight into how raw inputs are parsed into structured properties.

• Explore Multiple Rulesets in rsyslog to learn about isolating or chaining processing logic.

• The The Janitor Process and NetStream Drivers pages explain how background maintenance and low-level network handling work.

Together these topics give you a complete conceptual understanding of how rsyslog’s internal engine moves, filters, and stores log data.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.