You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Support RELP as an external logging protocol #1099
I understand that Ascender is open source software provided for free and that I might not receive a timely response.
Feature type
Enhancement to Existing Feature
Feature Summary
Assisted-by: Claude Opus 5.5. Drafted with AI assistance; every line cited was read at main640cf5f2 or in rsyslog's source, and the generated configuration was checked with rsyslogd -N1 on the image's base.
Accept relp as a LOG_AGGREGATOR_PROTOCOL and emit an omrelp action for it. RELP acknowledges each message at the application layer and retransmits what the aggregator didn't confirm; omfwd over plain TCP does neither, so whatever was in flight when a connection resets is lost with no record that it existed. The same request is open upstream as ansible/awx#16715.
Select the relevant components
UI
API
Docs
Collection
CLI
Other
Steps to reproduce
Configure external logging over TCP to an aggregator that also speaks RELP. rsyslog's imrelp is the common case, and a plain (non-TLS) RELP listener needs no certificates.
Cause a connection reset: restart the collector, or rotate the target behind a load balancer.
Compare what Ascender recorded against what the collector received. Messages the dead connection had already accepted are missing; action.resumeRetryCount="-1" reconnects but doesn't resend.
Try to switch to acknowledged delivery: PATCH /api/v2/settings/logging/ with LOG_AGGREGATOR_PROTOCOL=relp. It's rejected: the setting is a ChoiceField limited to https, tcp and udp in ascender/main/conf.py.
Try to supply the action another way. omrelp.so isn't in the image, because rsyslog-relp isn't installed, and the generated rsyslog.conf has no include to add an action to (filed separately, The generated rsyslog.conf no longer reads /var/lib/ascender/rsyslog/conf.d #1091; even with it restored, the module would still be missing).
Current results
TCP is the only streaming option, and it's unacknowledged. Every reset silently loses the messages in flight, and no configuration changes that: the setting won't accept relp, and even if it did, the module isn't in the image.
Sugested feature result
LOG_AGGREGATOR_PROTOCOL=relp produces an omrelp action with the same disk-assisted queue parameters as the other transports, and the image carries the module to load it. An installation that can reach a RELP listener then gets delivery that survives a reset, as a setting change.
Additional information
Four changes, all in the attached PR:
Change
File
('relp', 'RELP') added to the protocol choices
ascender/main/conf.py
An omrelp branch in the generator, emitting module(load="omrelp") and the action
ascender/main/utils/external_logging.py
relp added to the connectivity test endpoint's protocol list (otherwise it returns 202 without testing anything)
The package comes from the base image's own repositories. Rocky Linux 9 AppStream ships rsyslog-relp-8.2510.0-2.el9_8.2, the same version as the rsyslog the image already installs, and it provides omrelp.so. No new repository is involved. Checked on rockylinux/rockylinux:9: the generated omrelp configuration fails rsyslogd -N1 without the package (could not load module 'omrelp' ... cannot open shared object file) and passes with it.
Scope: no TLS. omrelp supports TLS (tls.caCert, tls.myCert, tls.myPrivKey, tls.authMode, tls.permittedPeer), and none of those can be expressed with today's settings: LOG_AGGREGATOR_VERIFY_CERT is a boolean used only by the omhttp branch, and the logging category has no certificate or key path settings. RELP over TLS needs settings for the CA, client certificate and key, plus a decision about how they reach the pod, which is a larger and separate change. The PR emits plain RELP and says so in the help text. Plain RELP is still a strict improvement over plain TCP: no less confidential, and it adds acknowledgement and retransmission. Installations needing confidentiality have HTTPS today.
Related: keepalives on the omfwd action (#1093) addresses the idle-flow cause of the same loss and is much smaller. The two are complementary: keepalives stop an idle flow from being discarded, RELP makes a reset from any other cause recoverable. RELP doesn't need keepalives for correctness, since an interrupted session is retransmitted.
Please confirm the following
Feature type
Enhancement to Existing Feature
Feature Summary
Assisted-by: Claude Opus 5.5. Drafted with AI assistance; every line cited was read at
main640cf5f2or in rsyslog's source, and the generated configuration was checked withrsyslogd -N1on the image's base.Accept
relpas aLOG_AGGREGATOR_PROTOCOLand emit anomrelpaction for it. RELP acknowledges each message at the application layer and retransmits what the aggregator didn't confirm;omfwdover plain TCP does neither, so whatever was in flight when a connection resets is lost with no record that it existed. The same request is open upstream as ansible/awx#16715.Select the relevant components
Steps to reproduce
imrelpis the common case, and a plain (non-TLS) RELP listener needs no certificates.action.resumeRetryCount="-1"reconnects but doesn't resend.PATCH /api/v2/settings/logging/withLOG_AGGREGATOR_PROTOCOL=relp. It's rejected: the setting is aChoiceFieldlimited tohttps,tcpandudpinascender/main/conf.py.omrelp.soisn't in the image, becausersyslog-relpisn't installed, and the generatedrsyslog.confhas no include to add an action to (filed separately, The generated rsyslog.conf no longer reads /var/lib/ascender/rsyslog/conf.d #1091; even with it restored, the module would still be missing).Current results
TCP is the only streaming option, and it's unacknowledged. Every reset silently loses the messages in flight, and no configuration changes that: the setting won't accept
relp, and even if it did, the module isn't in the image.Sugested feature result
LOG_AGGREGATOR_PROTOCOL=relpproduces anomrelpaction with the same disk-assisted queue parameters as the other transports, and the image carries the module to load it. An installation that can reach a RELP listener then gets delivery that survives a reset, as a setting change.Additional information
Four changes, all in the attached PR:
('relp', 'RELP')added to the protocol choicesascender/main/conf.pyomrelpbranch in the generator, emittingmodule(load="omrelp")and the actionascender/main/utils/external_logging.pyrelpadded to the connectivity test endpoint's protocol list (otherwise it returns 202 without testing anything)ascender/conf/views.pyrsyslog-relpadded to the runtime package listtools/ansible/roles/dockerfile/templates/Dockerfile.j2The package comes from the base image's own repositories. Rocky Linux 9 AppStream ships
rsyslog-relp-8.2510.0-2.el9_8.2, the same version as thersyslogthe image already installs, and it providesomrelp.so. No new repository is involved. Checked onrockylinux/rockylinux:9: the generatedomrelpconfiguration failsrsyslogd -N1without the package (could not load module 'omrelp' ... cannot open shared object file) and passes with it.Scope: no TLS.
omrelpsupports TLS (tls.caCert,tls.myCert,tls.myPrivKey,tls.authMode,tls.permittedPeer), and none of those can be expressed with today's settings:LOG_AGGREGATOR_VERIFY_CERTis a boolean used only by theomhttpbranch, and the logging category has no certificate or key path settings. RELP over TLS needs settings for the CA, client certificate and key, plus a decision about how they reach the pod, which is a larger and separate change. The PR emits plain RELP and says so in the help text. Plain RELP is still a strict improvement over plain TCP: no less confidential, and it adds acknowledgement and retransmission. Installations needing confidentiality have HTTPS today.Related: keepalives on the
omfwdaction (#1093) addresses the idle-flow cause of the same loss and is much smaller. The two are complementary: keepalives stop an idle flow from being discarded, RELP makes a reset from any other cause recoverable. RELP doesn't need keepalives for correctness, since an interrupted session is retransmitted.Reference: rsyslog omrelp.