On Thu, 2009-02-05 at 19:03 -0700, RB wrote: > On Thu, Feb 5, 2009 at 19:59, <[email protected]> wrote: > >> I'm more feeling things out than requesting a feature, but is there a > >> way to control when templates are evaluated? Say I'd like to name > >> some files with very specific timestamps, but instead of re-evaluating > >> the template every time it receives an event, just re-evaluate > >> whenever rsyslogd has cause to reopen the file. Am I sane? > > > > I could see the use for this sort of thing. > > The first use-case I had come up with was with an output channel - I > know they're scheduled to disappear, but it'd be quite nice to set a > size limit for the channel and see the over-limit "resolved" by > closing and re-opening.
Actually, I think this is the only use case. What we need to look at is when a file is closed. It is closed when there is need to. So, when is there need? There are currently three cases where need arises a) HUP or restart b) output channel max size logic c) change in filename (for dynafiles, only) I think we can ignore a) in this context. I agree that it may be useful in case b). For the time being let's focus on case c): I simplified a bit. Actually, the file is not closed immediately when the file name changes. The file is kept open, in a kind of cache. So when the very same file name is used again, the file descriptor is taken from the cache and there is no need to call open and close APIs (very time consuming). The usual case is that something like HOSTNAME or TAG is used in dynamic filename generation. In these cases, it is quite common that a small set of different filenames is written to. So with the cache logic, we can ensure that we have good performance no matter in what order messages come in (generally, they appear random and thus there is a large probability that the next message will go to a different file on a sufficiently busy system). A file is actually closed only if the cache runs out of space (or cases a) or b) above happen). Now let's think what happens if the dynamic name would not be evaluated. Let's stick with the hostname. We have the following message sequence: Host Msg A M1 A M2 B Ma A M3 B Mb and we have a filename template, for simplicity, that consists of only % HOSTNAME%. What now happens is that with the first message the file "A" is opened. Obviously, messages M1 and M2 are written to file "A". Now, Ma comes in from host B. If the name is newly evaluated, Ma is written to file B. Then, M3 again to file A and Mb to file B. If we do not evaluate the filename template, we have no need to switch files. Consequently, all messages (M1, ..., Mb) are written to file "B". That, however, we could achive without dynafiles at all, for example by doing a simple *.* /A The same happens when you use time-based properties: if you do not reevaluate the file name, you will never switch files, because the name stays always at the (somewhat random) initial value. So IMO this can not be a valid use-case. What you describe in your post (initial case b)) I would call a side-effect. As the file was closed due to size limitation, as a side-effect a new name could be generated. That is of interest because the name conveys the information how long it took to reach the file size. I think a solution to this need could be to emit a log message, telling which file was closed at what time (if an output channel reaches max size). Does this make sense? Or did I misunderstand your intentions? If I got it right, would the proposed new message on max file size (output channel) solve your need? I think that should be fairly easy to add. Looking forward to your replies. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
