Hello folks. I feel like I read a quote from Rainer at some point
outlining the difference in performance between the different types of
filters you can use in an rsyslog configuration.... I seem to remember
that the order went like this (starting with simplest / most efficient)
1. classic selectors
2. simple property-based (:property, compare, "value")
3. expression-based if statements (now RainerScript)
I'm absolutely sure classic selectors offer best performance, when you
can use them, but I'm not so sure about the difference between
property-based vs RainerScript. Is my outline above accurate, assuming
the same simple test -- something like "$fromhost-ip startswith"?
Of particular interest to me is whether there is a large discrepancy in
the performance differences between these two (property-based &
RainerScript) in rsyslog v5 and rsyslog v7. Obviously, I'm well aware of
how RainerScript was still being fleshed-out in v5 and I'm sure there
have been performance improvements. I also know that
[http://www.rsyslog.com/doc/rsyslog_conf_filter.html] has an odd
mention of property-based filters:
> Also, the traditional syslog PRI-based filters are a good and easy to
> use addition. While they are legacy, we still recommend there use where
> they are up to the job. We do NOT, however, recommend property-based
> filters any longer. ...
So, in short, my questions are:
* How big of a performance difference is there between property-based &
RainerScript filters when doing a simple check?
* Is there a large difference in this .. difference between rsyslog v5
and rsyslog v7? (I mostly use v5 in production on RHEL & Fedora. And
yes, I'm well-aware of [and thankful for] the new rpm repo.)
Thanks for reading!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
