As per the answers here and here, restarting rsyslog is the correct way to do a config reload. But logs which rsyslog may have been processing at the time may be lost.
Is there a way to avoid this by having rsyslog temporarily store the logs in a file before going down (since we expect a graceful restart) and then read those first as soon as it comes back up again ? When systemd is used, this will help because any new logs will be buffered in the activated socket and can be read after rsyslog finishes reading the temporary log file.
systemdto ensure that every log entry is written to disk. In my experience, even if you try to completely disable log throttling, at some pointsystemddecides to drop log entries anyway. And thensystemdeffectively never logs anything from that application until the system is rebooted. – Andrew Henle Feb 15 '21 at 23:38What I meant in my question was that when rsyslog goes down for a restart, the new messages from journal will still be buffered in the activated /run/systemd/journal/syslog socket even if rsyslog takes time to come up and start reading them.
– Jayanth Feb 16 '21 at 06:53