On Tue, 1 Feb 2011, martin f krafft wrote:
also sprach [email protected] <[email protected]> [2011.02.01.2006 +0100]:
your distro may have something like this, but Ubuntu already does all
output directives through include files, so why not just replace
those include files?
Because it means I need to maintain them, rather than leave this job
up to the package maintainer and use the defaults as much as
possible. Debian (Ubuntu) has conffiles and all, making sure that my
changes never get overwritten; but it's often worth to go a step
further and make things even more parametrisable. The goal of every
sysadmin should be to minimise the deviation from the distro
default.
the problem with just running all filenames through a filter is that
you also want to change normal, fixed filenames to dynamic filenames.
this requires that the filename be evaluated for each log message as
opposed to just at open time. There is a significant performance hit
to doing this, one that people who don't use synamid filenames will
not want to pay.
This is true. At the moment, you have a much lesser performance hit
due to template evaluation. I would prefer an internal mangler to an
external filter, so that the performance hit would be negligible
over template evaluation.
actually, for the most part you don't have template evaluation when
writing logs either.
the four most common log formats have hard-coded templates available
(which resulted in a noticable speedup when they were implemented), and
the file is only evaluated at startup/HUP time and from that point on it's
just a write to an open file handle, it doesn't even look at the log file
name.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
