18.10.2013 15:14, Rainer Gerhards wrote:
Secondly, as you noted, the action interface traditional permits only one thread at a time to be inside the actual action. For "the usual cases", this is of little problem, but there are cases where permiting multiple entries would be very benefitial. mmnormalize is among them. I would like to change both, but need a sponsor to do this quickly. On my non-sponsored todo list, the second issue is with a somewhat higher priority than the first one. I would hope I could work on it within the next 6 to 9 month. Hopefully I will even be able to do some initial analysis soon, which could speed up the process if it appears to be more trivial than I currently think. Rainer
OK, it's clear, but I will try to elaborate this subject by myself. I'll post on it later.
Second, in 7.5.5, this does not work at all. In 7.4.4, mmnormalize produces expected output, though it cannot keep the load and has known memory leak. On the other hand, in 7.5.5 it produces rare records in the output file (say, 100 per minute). It looks like it cannot match other records, but this is weird, as they are all in the same format and happily match in lognormalize.
Maybe I've just found why is this. Different output modules seem to be called in parallel in 7.5.5, and mmnormalize adopts output module interface. Therefore, if mmnormalize is faster than omfile, then omfile can see results of mmnormalize. But it is very unlikely.
Am I right? Is parser module interface better for message modification modules?
-- Pavel Levshin _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
