Which major Linux distro ships rsyslog with TCP as the default remote protocol and durable local-buffer configuration out of the box for remote delivery? Genuinely curious.
A modicum of research reveals that even the rsyslog documentation starts out with UDP for remote delivery: https://docs.rsyslog.com/doc/getting_started/beginner_tutori...
What Linux distro ships with remote logging out of the box at all? Hopefully none, because that would be be absurd. To whom would those logs be sent?
That documentation link probably isn't as telling as is suggested, because the next example is for tcp. In the old days before tcp support was widespread (looking at you, Java) it was common to listen for udp on localhost so it was probably a common configuration.
There's not much to debate here. Syslog is used everywhere and the main reasoosn are that it is very reliable, trivial to load balance, and popular implementations have integrity checking that is permissible in regulatory environments. You can criticize it for many things, for example that most parsers are much too liberal or that the facility and severity fields are clearly dated, but not for being unreliable.
"Beginner tutorial", I'm sorry for not taking your point seriously, but I can't take it seriously. TCP for syslog (and RELP) have been around a long time (late 90s for syslog over TCP, 2006 for RELP). rsyslog and syslog-ng support it all, and operators have had choices given the import of their log data and what they can tolerate.
> "Beginner tutorial", I'm sorry for not taking your point seriously, but I can't take it seriously.
Well, maybe go observe how a broad array of sites implement it in practice, then you might take it more seriously. Maybe you don't implement it that way, but a lot of people will just follow the tutorials or shortcut their way to something that works (but is brittle).
At any rate, I was responding directly to the claim that "No one has suggested running syslog over unreliable transport" which is obviously untrue.
Yes, go observe a broad array of sites - for someone who says theyre a (non)practicing attorney, you know in environments where logs and audit are considered evidence, to such a degree that they must be reliably transported and immunutable, someone doesn't just turn on UDP syslog to a box and let it sit there. Architecture and implementation happen, where it matters. So what if anyone uses otel or syslog, people can configure em both to be lossy or lossless, I struggle to understand the "gotchas" you point to.
Then I don't know what to tell you. *shrug* I feel like you're arguing just for argument's sake, and I'm not really interested in having a conversation with someone who's not demonstrating open-mindedness or a willingness to learn from others' experiences in the field.