Store and Forward

Once rsyslog Windows Agent collects an event and it matches a rule, actions can forward it to downstream systems or alter the processing flow internally.

Where to configure

• Actions is the entry point for forwarding and internal processing behavior.

Common forwarding targets

• Syslog: Forward Syslog

• RELP: Send RELP

• TLS-protected syslog: use the TLS options inside Forward Syslog

• DTLS: Send DTLS

Common internal actions

• Call RuleSet

• Normalize Event

• Set Property

• Set Status

• Discard

Recommended setup path

1. Start with one forwarding target and verify end-to-end delivery.

2. Prefer reliable transports when message loss is not acceptable.

3. Add internal actions only after the forwarding path behaves as expected.

4. If you need outage tolerance, configure disk-backed queues where the action supports it.