On 06/19/2013 04:34 PM, Rainer Gerhards wrote:
On Wed, Jun 19, 2013 at 2:48 PM, Radu Gheorghe<[email protected]>wrote:
Hi Risto,
Yes, I've used omprog and it's a good temporary solution :) There are two
things I've bumped into:
- performance. If you can develop (or pay Adiscon to develop) a rsyslog
output plugin that can do what your external program does, it will probably
be way faster. Because it can make use of rsyslog's features, like having
multiple threads or processing logs in batches
I guess Risto will run some input to SEC - am I right here?
...in fact, I was thinking about creating a SEC FAQ entry which would
discuss different options for connection SEC to rsyslog. Typically, the
users have let it to monitor rsyslog's output files, since as Radu
mentioned, there is no message loss problem with regular files. Of
course, with pipes (be it named or memory based) there is always the
"small buffer issue", but in more recent linux kernels the buffers have
grown in size. For this reason, I was thinking of discussing shortly the
cons and pros of each approach. And after reading the omprog docs, I was
just wondering if there are some other and fancier ways for offering
stdin-from-pipe interface for external programs :)
Another question -- in the omprog source code I noticed a comment that
writing into pipe is not entirely block-free? Does it mean that if
external program is not reading fast enough, the rsyslog thread which
writes into pipe could block for a brief moment?
kind regards,
risto
- reliability. omprog will restart your external program if it goes down
for any reason. But your external program needs to ingest messages quickly,
otherwise the pipe will get full (and it's 4-64K, it's not clear to me.
Tiny, anyway). At that point you will lose messages.
I have just checked the code and that is not intentional. I may have
overlooked something, as omprog was originally writen to a user request,
but that users disappeared when it was done and nobody else reported much
on it. I think this is the right solution for external programs, and so I
would be very happy to look into problems that the module may have.
Rainer
I'd say omprog is good if you don't care very much about those two. If you
do, I'd either look at a new plugin or at writing to a file and picking up
those logs from a file (or distributed file system?). Writing to a file
opens another can of worms (like, your app has to know where it left off
when it restarts), but at least you have a beefy buffer.
2013/6/19 Risto Vaarandi<[email protected]>
hi all,
I was wondering what would be the best way to run an external program
from
rsyslogd, so that the program's stdin would be connected to rsyslogd
over a
pipe.
From the rsyslogd docs, I've found the omprog module as one possible
solution. For example, the following statements
$ModLoad omprog
$ActionOMProgBinary /root/test.sh
*.* :omprog:
run /root/test.sh from rsyslogd and feed all log messages to the standard
input of /root/test.sh.
My question is -- are there any other (or better) ways for achieving the
same setup?
(Of course, one obvious way would be to use a named pipe for
communication.)
kind regards,
risto
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<
http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<
http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
