OffPeakHours

From rsyslog wiki

Rsyslog can be used to send messages during off-peak hours. This feature was introduced in 3.17.0 and, as of this writing, still needs some serious testing in a practice environment. The feature is implemented at the queue engine level and thus can be used both for the main message queue as well as for each individual action queue. It probably helps to understand rsyslog queues before you implement it, but if you just want to give it a try, you can use this configuration sample:

rsyslog.conf:

# reliably transmit messages to the remote server, but only
# during off-peak hours (10p to 4a)
$ModLoad omrelp # load relp output support

$WorkDirectory /rsyslog/work # where to place the spool files?

$ActionQueueType LinkedList # enable a separate queue for this action
$ActionQueueDequeueTimeBegin 22
$ActionQueueDequeueTimeEnd 4
$ActionQueueFileName relpact
# The following directive is vitally important: it ensures that
# all queue data is written to disk when rsyslogd is terminated
# without it, you'll lose data
$ActionQueueSaveOnShutdown on
*.* :omrelp:172.19.2.10:2514

We have used relp in this sample because we can't think of any reason not to use RELP. But of course you can also use it with plain tcp syslog or, if you really don't care about your messages, with UDP syslog.

And, of course, it also works with all other actions. Among them, it is probably most useful together with database actions. So you can spool all messages to disk during the day and ponder your database engine during the night when it otherwise would happily be idling around ;) (be warned: for obvious reasons, your database content will never again be fully up to date...).