On Tue, 3 Nov 2009, Rainer Gerhards wrote: > Yes, thats right if you use the new buffered mode. The cure is either not to > do that or use the new omruleset.
so the new buffered mode even without seperate action queues or omruleset can have this problem? David Lang > ----- Urspr?ngliche Nachricht ----- > Von: "[email protected]" <[email protected]> > An: "rsyslog-users" <[email protected]> > Gesendet: 03.11.09 19:52 > Betreff: Re: [rsyslog] queue configuration > > On Tue, 3 Nov 2009, Rainer Gerhards wrote: > >> David and all, >> >> I have created a new output plugin, omruleset, which permits to nest >> rulesets. What it does is copy a message over from one ruleset to another and >> make it process in parallel. Some more details in the doc: >> >> http://www.rsyslog.com/doc-omruleset.html > > this looks very interesting, however there is one thing mentioned here > that concerns me. > > it sounds like you are saying that if you have multiple rules that write > to the same file that you may get the content of various lines mixed > togeather. > > am I understanding this correctly? > > if so, is there any way to work around this? > > David Lang > >> It permits to do what you asked for below. It also permits to do many more >> things and create very advanced configurations. But one must be VERY careful >> to receive the intended results. >> >> Rainer >> >>> -----Original Message----- >>> From: [email protected] [mailto:rsyslog- >>> [email protected]] On Behalf Of [email protected] >>> Sent: Friday, October 23, 2009 10:23 PM >>> To: rsyslog-users >>> Subject: [rsyslog] queue configuration >>> >>> I know that you can create an action queue for a specific output. >>> >>> is there any way to create an action queue for multiple outputs? >>> >>> for example, in my configuration I have >>> >>> :fromhost, !isequal, "127.0.0.1" >>> /var/log/messages;TraditionalFormat >>> :fromhost, isequal, "127.0.0.1" >>> @192.168.1.1;TraditionalForwardFormat >>> *.* @192.168.1.115 >>> *.* @192.168.1.241 >>> *.* @192.168.1.242 >>> *.* @192.168.1.6 >>> *.* @192.168.1.7 >>> *.* @192.168.1.122 >>> :hostname, contains ,"MSWinEventLog" /var/log/messages;fixsnareFormat2 >>> & @192.168.1.1;fixsnareForwardFormat2 >>> & ~ >>> :syslogtag, startswith, "MSWinEventLog#011" >>> /var/log/messages;fixsnareFormat >>> & @192.168.1.1;fixsnareForwardFormat >>> & ~ >>> *.* /var/log/messages;TraditionalFormat >>> *.* @192.168.1.1 >>> >>> it would be nice to move the outbound relays off to a different queue, >>> and >>> to put the list of rules that have order dependancies (because they >>> output >>> in different formats to fix up formatting problem) to a seperate queue >>> to >>> spread the work across multiple processes and not slow down the basic >>> writing to file. >>> >>> but as far as I can tell I would have to create a queue for each >>> individual item, and I can't create a queue for the part of the config >>> where I need to discard. >>> >>> am I missing something (including a better way to do everything ;-) >>> >>> David Lang >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
