Think about this: actions are independent of each other. If different actions write to the same file, they do that independently. If these actions now buffer before they write, they do that independently. Consequently, the writes get mixed up. Without buffering, each os write is done seperately, so the OS keeps each of the records appended to the file.
----- Ursprüngliche Nachricht ----- Von: "[email protected]" <[email protected]> An: "rsyslog-users" <[email protected]> Gesendet: 03.11.09 20:30 Betreff: Re: [rsyslog] queue configuration On Tue, 3 Nov 2009, Rainer Gerhards wrote: > Yes, thats right if you use the new buffered mode. The cure is either not to > do that or use the new omruleset. so the new buffered mode even without seperate action queues or omruleset can have this problem? David Lang > ----- Urspr?ngliche Nachricht ----- > Von: "[email protected]" <[email protected]> > An: "rsyslog-users" <[email protected]> > Gesendet: 03.11.09 19:52 > Betreff: Re: [rsyslog] queue configuration > > On Tue, 3 Nov 2009, Rainer Gerhards wrote: > >> David and all, >> >> I have created a new output plugin, omruleset, which permits to nest >> rulesets. What it does is copy a message over from one ruleset to another and >> make it process in parallel. Some more details in the doc: >> >> http://www.rsyslog.com/doc-omruleset.html > > this looks very interesting, however there is one thing mentioned here > that concerns me. > > it sounds like you are saying that if you have multiple rules that write > to the same file that you may get the content of various lines mixed > togeather. > > am I understanding this correctly? > > if so, is there any way to work around this? > > David Lang > >> It permits to do what you asked for below. It also permits to do many more >> things and create very advanced configurations. But one must be VERY careful >> to receive the intended results. >> >> Rainer >> >>> -----Original Message----- >>> From: [email protected] [mailto:rsyslog- >>> [email protected]] On Behalf Of [email protected] >>> Sent: Friday, October 23, 2009 10:23 PM >>> To: rsyslog-users >>> Subject: [rsyslog] queue configuration >>> >>> I know that you can create an action queue for a specific output. >>> >>> is there any way to create an action queue for multiple outputs? >>> >>> for example, in my configuration I have >>> >>> :fromhost, !isequal, "127.0.0.1" >>> /var/log/messages;TraditionalFormat >>> :fromhost, isequal, "127.0.0.1" >>> @192.168.1.1;TraditionalForwardFormat >>> *.* @192.168.1.115 >>> *.* @192.168.1.241 >>> *.* @192.168.1.242 >>> *.* @192.168.1.6 >>> *.* @192.168.1.7 >>> *.* @192.168.1.122 >>> :hostname, contains ,"MSWinEventLog" /var/log/messages;fixsnareFormat2 >>> & @192.168.1.1;fixsnareForwardFormat2 >>> & ~ >>> :syslogtag, startswith, "MSWinEventLog#011" >>> /var/log/messages;fixsnareFormat >>> & @192.168.1.1;fixsnareForwardFormat >>> & ~ >>> *.* /var/log/messages;TraditionalFormat >>> *.* @192.168.1.1 >>> >>> it would be nice to move the outbound relays off to a different queue, >>> and >>> to put the list of rules that have order dependancies (because they >>> output >>> in different formats to fix up formatting problem) to a seperate queue >>> to >>> spread the work across multiple processes and not slow down the basic >>> writing to file. >>> >>> but as far as I can tell I would have to create a queue for each >>> individual item, and I can't create a queue for the part of the config >>> where I need to discard. >>> >>> am I missing something (including a better way to do everything ;-) >>> >>> David Lang >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
