> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Wednesday, January 20, 2010 5:57 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog 5.3.6 (v5-beta) released > > On Wed, 20 Jan 2010, Rainer Gerhards wrote: > > > David, > > > > thanks for the feedback - and a quick note. > > > > With the new engine, you can do ruleset inclusion (via omruleset[1]). > That is > > probably *the* method to handle files that are written to by multiple > > actions. Of course, no need to change if all works in default config. > But you > > can gain some extra performance by using buffered mode (for busy > files) and > > to use that, you need to have only one action write to each file. > This is > > where ruleset inclusion enters the game. > > thanks for this, I was thinking about how this could be improved, but > this > looks like it deals with the issue. > > on my central box I currently have all the logs written to one file, > roll > that every 5 min, and then at night split this into 45 different files > based on 100 simplified program names (where I strip out versions so > that > blah-2.3[123] and blah-2.4[123] end up in the same file). I was > thinking > of experimenting to see what happened if I did this in rsyslog instead. > This is a very good pointer to what I would need to do.
I would be quite interested in feedback on omruleset. I doubt anyone has put it into production yet, at least in a demanding environment (aka "bugs to be expected" ;)). Note that this functionality is very hard to configure with the current config language... (it was omruleset that made me believe that finally something must be done to improve that part of the system). Rainer > > David Lang > > > Rainer > > > > [1] http://www.rsyslog.com/doc-omruleset.html > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of [email protected] > >> Sent: Wednesday, January 20, 2010 12:26 AM > >> To: rsyslog-users > >> Subject: Re: [rsyslog] rsyslog 5.3.6 (v5-beta) released > >> > >> I've now had v5.3.6 running on my production environemnets since > friday > >> with no problems > >> > >> one side effect of the cleanups is that previously when I had > multiple > >> filters write to one file I was getting lots of corrupt lines, but > the > >> change to have omfile write each transaction rather than just as the > >> buffer filled up seems to have eliminated this (it went from 10's of > >> thousands of corrupted lines/day to none over the weekend and > monday, > >> tonight's report will be the acid test to see if it's fully cleaned > up) > >> > >> I realize there is still a window for corruption (if two output > threads > >> running at the same time both decide they need to write at the same > >> time), > >> but it seems that in practice it's effectively gone. > >> > >> David Lang > >> > >> On Fri, 15 Jan 2010, [email protected] wrote: > >> > >>> On Fri, 15 Jan 2010, Michael Biebl wrote: > >>> > >>>> BTW, I'm actually surprised that you don't encounter those > problems > >>>> yourself. > >>> > >>> I'm running 5.3.5 still, I haven't had time to build a new version > >> (hopefully > >>> tomorrow) > >>> > >>> David Lang > >>> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
