> The problem with this approach is twofold. First, we are experiencing > performance issues under increased load (all Apache workers in status "L" > on the Apache server status page when stress testing).
I am somewhat surprised neither of the responders did what seems obvious to me and bypass the pipe/execution altogether. Unless someone else here has had a problem doing so, there's no reason you couldn't just use a named pipe on both ends: [shell] mkfifo /var/run/htlog-1 [apache] CustomLog "/var/run/htlog-1" [rsyslog] $ModLoad imfile $InputFileName /var/run/htlog-1 $InputFileTag apache1 $InputFileRunMonitor That puts the logs in rsyslog with no extra executions or running processes; what you do after that for filtering is up to you. The nice thing about using a named pipe is that if the reading process dies, the buffer doesn't go away and you have less chance of losing messages. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
