On Tue, 3 Nov 2009, Rainer Gerhards wrote: > David and all, > > I have created a new output plugin, omruleset, which permits to nest > rulesets. What it does is copy a message over from one ruleset to another and > make it process in parallel. Some more details in the doc: > > http://www.rsyslog.com/doc-omruleset.html
this looks very interesting, however there is one thing mentioned here that concerns me. it sounds like you are saying that if you have multiple rules that write to the same file that you may get the content of various lines mixed togeather. am I understanding this correctly? if so, is there any way to work around this? David Lang > It permits to do what you asked for below. It also permits to do many more > things and create very advanced configurations. But one must be VERY careful > to receive the intended results. > > Rainer > >> -----Original Message----- >> From: [email protected] [mailto:rsyslog- >> [email protected]] On Behalf Of [email protected] >> Sent: Friday, October 23, 2009 10:23 PM >> To: rsyslog-users >> Subject: [rsyslog] queue configuration >> >> I know that you can create an action queue for a specific output. >> >> is there any way to create an action queue for multiple outputs? >> >> for example, in my configuration I have >> >> :fromhost, !isequal, "127.0.0.1" >> /var/log/messages;TraditionalFormat >> :fromhost, isequal, "127.0.0.1" >> @192.168.1.1;TraditionalForwardFormat >> *.* @192.168.1.115 >> *.* @192.168.1.241 >> *.* @192.168.1.242 >> *.* @192.168.1.6 >> *.* @192.168.1.7 >> *.* @192.168.1.122 >> :hostname, contains ,"MSWinEventLog" /var/log/messages;fixsnareFormat2 >> & @192.168.1.1;fixsnareForwardFormat2 >> & ~ >> :syslogtag, startswith, "MSWinEventLog#011" >> /var/log/messages;fixsnareFormat >> & @192.168.1.1;fixsnareForwardFormat >> & ~ >> *.* /var/log/messages;TraditionalFormat >> *.* @192.168.1.1 >> >> it would be nice to move the outbound relays off to a different queue, >> and >> to put the list of rules that have order dependancies (because they >> output >> in different formats to fix up formatting problem) to a seperate queue >> to >> spread the work across multiple processes and not slow down the basic >> writing to file. >> >> but as far as I can tell I would have to create a queue for each >> individual item, and I can't create a queue for the part of the config >> where I need to discard. >> >> am I missing something (including a better way to do everything ;-) >> >> David Lang >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
