> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Champ Clark III [Softwink] > Sent: Friday, October 08, 2010 5:18 PM > To: rsyslog-users > Subject: Re: [rsyslog] Sagan + Rsyslog [$template question] > > > > This looks good. The only thing I see instantly is that we could > spare a view > > CPU cycles (with recent v5 builds) if we use a strgen module. A > strgen > > effectively builds the template string via C code instead of the > template > > processor and thus is a bit faster and more flexible. Nothing to > really care > > about for low to medium number of messages, but makes a small > difference if > > you have severl ten-thousand messages per second. It isn't hard to > write one > > and I think I could contribute it some time next week if you find it > useful. > > I don't know if you've looked at the Sagan page, but I'm always > about sparing a few CPU cycles :)
I did, and this was the reason I mentioned strgens ;) > I also read your paper on taking > rsyslog from 40k to 250k of mps (can't recall the exact name). It's > a nice write up, and certainly gave me some ideas about improving the > preformance of Sagan. Thanks! If you think it is useful, please pass it on. My hope is that it will be useful especially in this transition phase from single- to multi-threaded paradigms. > > If you have some spare time to contribute the strgen processor, > that'd be great! Do you have any 'example strgen' code I could look > at? > I might take a wack at it :) They are *very* simple. The one used for the regular flat file format is here: http://git.adiscon.com/?p=rsyslog.git;a=blob;f=tools/smtradfile.c;h=eff2f99a6 4f8f5da69855a4df1bf8d5e8ea2fb02;hb=HEAD This is a built-in module, the plumbing is very slightly different for loadable ones - but I can do a conversion in 2 minutes ;) > >> and %syslogtag% functionality seems to be a bit different. For > >> example: > >> > >> Syslog-ng "$TAG" == 1e > >> rsyslog-ng %syslogtag% == the program name (for example: 'rsync:') > > > > I really don't know what syslog-ng does here. Is it really the string > 1e or > > the Ascii char 1e? If so, this is very strange to me. SYSLOG-TAG is > defined > > in RFC5424 and traditional meaning is described in RFC 3164. rsyslog > uses > > these definitions. But I don't know syslog-ng at all, so I do not > know what > > they call the "tag". But obviously they have applied a non-standard > meaning > > to this name. > > It's the string "1e". It's not always that, but it's basically > a hex looking 'string'. It's not terribly important, as I don't > think > I have any rules for Sagan that actually use the 'tag'. I've been > confused > about that for a while, and I'm glad I'm not the only one :) Lol ;) Rainer > -- > Champ Clark III | Softwink, Inc | 800-538-9357 x 101 > http://www.softwink.com > > GPG Key ID: 58A2A58F > Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F > If it wasn't for C, we'd be using BASI, PASAL and OBOL. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
