On Wed, 20 Jan 2010, Rainer Gerhards wrote: > David, > > thanks for the feedback - and a quick note. > > With the new engine, you can do ruleset inclusion (via omruleset[1]). That is > probably *the* method to handle files that are written to by multiple > actions. Of course, no need to change if all works in default config. But you > can gain some extra performance by using buffered mode (for busy files) and > to use that, you need to have only one action write to each file. This is > where ruleset inclusion enters the game.
thanks for this, I was thinking about how this could be improved, but this looks like it deals with the issue. on my central box I currently have all the logs written to one file, roll that every 5 min, and then at night split this into 45 different files based on 100 simplified program names (where I strip out versions so that blah-2.3[123] and blah-2.4[123] end up in the same file). I was thinking of experimenting to see what happened if I did this in rsyslog instead. This is a very good pointer to what I would need to do. David Lang > Rainer > > [1] http://www.rsyslog.com/doc-omruleset.html > >> -----Original Message----- >> From: [email protected] [mailto:rsyslog- >> [email protected]] On Behalf Of [email protected] >> Sent: Wednesday, January 20, 2010 12:26 AM >> To: rsyslog-users >> Subject: Re: [rsyslog] rsyslog 5.3.6 (v5-beta) released >> >> I've now had v5.3.6 running on my production environemnets since friday >> with no problems >> >> one side effect of the cleanups is that previously when I had multiple >> filters write to one file I was getting lots of corrupt lines, but the >> change to have omfile write each transaction rather than just as the >> buffer filled up seems to have eliminated this (it went from 10's of >> thousands of corrupted lines/day to none over the weekend and monday, >> tonight's report will be the acid test to see if it's fully cleaned up) >> >> I realize there is still a window for corruption (if two output threads >> running at the same time both decide they need to write at the same >> time), >> but it seems that in practice it's effectively gone. >> >> David Lang >> >> On Fri, 15 Jan 2010, [email protected] wrote: >> >>> On Fri, 15 Jan 2010, Michael Biebl wrote: >>> >>>> BTW, I'm actually surprised that you don't encounter those problems >>>> yourself. >>> >>> I'm running 5.3.5 still, I haven't had time to build a new version >> (hopefully >>> tomorrow) >>> >>> David Lang >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
