On Tue, Jun 22, 2010 at 6:23 AM, Rainer Gerhards
<[email protected]> wrote:
> The sample is available at
>
> http://www.rsyslog.com/download/xml_params_rsyslog.conf
I have to admit, having not viewed it in something with context
highlighting, I am somewhat agreeing with David. This is where my
aversion to XML comes out.... but it achieves the suggestions I put
forward. A little bit of my own suggestion, based on what is already
there... I would certainly prefer something like this:
<?xml version="1.0"?>
<!--DOCTYPE config SYSTEM "config-v00.dtd"-->
<config application="rsyslog" version="1" YYYY-MM-DD="2010-06-21">
<!---
Define modules in their own scope with no module-specific tags,
as they will define their tags at load time
--->
<modules>
<path>/path/to/modules</path>
<module id=imtcp />
<module id=imudp />
<module id=omruleset />
</modules>
<!---
Then configure the modules
--->
<modconf id="imtcp">
<maxlisten>512</maxlisten>
<maxsession>8192</maxsession>
</modconf>
<!-- imtcp has registered itself as an input type, and has added
accepted nodes to the input field -->
<input type="imtcp" name="im10514">
<listen>
<port>10514</port>
<bind>123.123.123.123</bind>
</listen>
<!--- inputs need a sink or output to direct their content
to... also, inline comments should be permitted -->
<!--- perhaps omruleset has registered "ruleset" as an
acceptable sink type? --->
<sink type="ruleset">remote10514</sink>
</input>
<input type="imtcp"><listen><port>10515</port></listen><sink
type=ruleset>remote10515</sink></input>
<sink type="ruleset">
<rule>
<!-- no filter specified -- all messages! -->
<action type="omfile">
<file>/var/log/catchall</file>
<sync />
</action>
<action use="dynfile" /> <!-- use action defined elsewhere -->
</rule>
</sink>
Granted - I go in a few different directions here, but I'm just
brainstorming. A few things:
1. Modules define types - the top levels should be
module-independent... ie, no <ruleset> if omruleset is required for
it.
2. I like the concept of a sink into which an input dumps its data -
that was something you mentioned in an earlier post. I went with it,
not because I think its the best term, but because it worked in this
case.
Thoughts?
-Aaron
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
