rsyslog-segqueue(1)

📦
version 8.2610.0 · 2 versions
, in nixos 26.05

💅 rsyslog-segqueue — a lil' field guide (manual page, rsyslog-segqueue(1))

okay so bestie, welcome to the rsyslog-segqueue(1) page — General Commands Manual energy, but make it make sense 🫶

✨ NAME ✨

rsyslog-segqueue — keep your segmentedDisk queue stores in check while they're offline, no cap 💖

🌸 SYNOPSIS 🌸

rsyslog-segqueue status QUEUE-DIR [--json]
rsyslog-segqueue check QUEUE-DIR [--json]
rsyslog-segqueue export QUEUE-DIR [--output FILE|-]
                        [--scope live|all] [--salvage]
rsyslog-segqueue repair QUEUE-DIR --mode state-slot|rebuild|salvage
                        [--apply --offline] [--json]
rsyslog-segqueue tui [QUEUE-DIR]

🦋 DESCRIPTION 🦋

So rsyslog-segqueue is the tool that inspects, exports, and repairs the version 2 store that queue.type="segmentedDisk" uses. That's the whole vibe. 💅

Lowkey important: it does not operate on classic .qi disk queues. Not its business, not its era. The queue directory you point it at is normally <workDirectory>/<queue.filename>.segq.

status, check, and export are all read-only — they observe, they don't touch. They can detect a store that changes while repair is being prepared, but they literally cannot give you a coherent snapshot while rsyslog is actively writing to the queue. Physics, bestie. 😭

Stop rsyslog before applying any repair. Like, actually stop it. This is not a drill, this is not optional, this is the whole safety briefing. 🚨

👑 COMMANDS 👑

⭐ status

Reads the state slots and the segment metadata. The report gives you the selected state generation, the queue UUID, the commit frontier, the live/recovery/delete ranges, the physical size, and any inconsistencies that are immediately visible.

Heads up: payloads are not scanned. This is the quick vibe check, not the full audit. 🎀

🔥 check

Scans the complete store. Full send. The checks cover:

  • state-slot checksums and invariants
  • segment headers and footers
  • topology
  • record framing and sequence numbers
  • payload checksums
  • the versioned TLV message codec

Every error comes with a stable code and a location, so you can actually find the thing instead of crying. 😭✨

🧚 export

Writes one JSON object per valid record.

The default --scope live starts at the durable commit frontier. --scope all also pulls in physical records that the state identifies as already committed or pending deletion. Obsessed with the control here tbh.

Export refuses a corrupt store by default — it's got boundaries. --salvage is what lets it export independently valid records, report the omissions, and exit with status 2.

Formatting deets:

  • Valid UTF-8 gets written as a JSON string 💖
  • Other byte strings get represented as an object with encoding set to base64 and a lossless data value
  • For an unparsed message whose stored message offset is rsyslog's 0xffffffff sentinel, msg contains the complete raw message and msg_offset_unset is true

🌈 repair

Real talk: repair is a no-write plan unless you give it both --apply and --offline. Both. Not one. Both. 🫶

The modes are:

  • state-slot — Recreate one invalid state slot from the surviving valid slot and preserve its commit frontier.
  • rebuild — Require clean, unambiguous segment data, and construct a normalized store in which every recovered record is pending.
  • salvage — Resynchronize after corrupt framing, retain every record whose framing, payload checksum, and codec validate, and construct a normalized store.

⚠️ rebuild and salvage may replay records that had already been processed, because an unusable state file cannot prove the old commit frontier. This deliberate duplicate-over-loss policy is always shown in the repair plan — it's not sneaky, it's right there in the plan, iykyk.

Applied repairs retain the original state file or queue directory under a UTC-timestamped backup name. rebuild and salvage validate a same-filesystem staging store before atomically renaming the original. And backups are never deleted automatically — they're yours forever, main character artifacts. 👑

💜 tui

Opens a dependency-free guided terminal menu. It invokes the same commands as everything above, and it requires you to type the exact queue path before it'll apply a repair. Type it correctly or no slay for you. 💅

🎀 OPTIONS 🎀

  • --json — Emit a machine-readable status, check, or repair report.
  • --output FILE|- — Write JSON Lines to FILE. - selects standard output, and that's the default.
  • --scope live|all — Select logically live records or all physical records. Default is live.
  • --salvage — Permit a partial JSONL export from a corrupt store.
  • --apply — Apply a repair plan. This also requires --offline (yes, again, because it matters).
  • --offline — Acknowledge that rsyslog is stopped and will not access the queue during the repair.

🫶 EXIT STATUS 🫶

  • 0 — The command completed successfully and no integrity errors were found. ✨ slay.
  • 1 — Invocation, filesystem, or internal processing failed. 💀
  • 2 — Integrity errors were found, or a salvage export completed with omissions.

🍓 EXAMPLES 🍓

rsyslog-segqueue status /var/spool/rsyslog/mainq.segq
rsyslog-segqueue check --json /var/spool/rsyslog/mainq.segq
rsyslog-segqueue export /var/spool/rsyslog/mainq.segq --output backlog.jsonl
rsyslog-segqueue repair /var/spool/rsyslog/mainq.segq --mode salvage
rsyslog-segqueue repair /var/spool/rsyslog/mainq.segq --mode salvage --apply --offline

🌟 SEE ALSO 🌟

rsyslogd(8), rsyslog.conf(5) — go read those too, bestie, they're the supporting cast 🧚

💖 that's the whole page!! mwah 💖 — this was rsyslog-segqueue(1), part of the general commands manual, and yes the footer really does just say rsyslog-segqueue(1) down there in the corner. periodt. 🌈

📦 where this page comes from