On Sat, 19 Oct 2013, Pavel Levshin wrote:
18.10.2013 15:14, Rainer Gerhards wrote:
Secondly, as you noted, the action interface traditional permits only one
thread at a time to be inside the actual action. For "the usual cases",
this is of little problem, but there are cases where permiting multiple
entries would be very benefitial. mmnormalize is among them. I would like
to change both, but need a sponsor to do this quickly. On my non-sponsored
todo list, the second issue is with a somewhat higher priority than the
first one. I would hope I could work on it within the next 6 to 9 month.
Hopefully I will even be able to do some initial analysis soon, which could
speed up the process if it appears to be more trivial than I currently
think. Rainer
OK, it's clear, but I will try to elaborate this subject by myself. I'll post
on it later.
Second, in 7.5.5, this does not work at all. In 7.4.4, mmnormalize
produces expected output, though it cannot keep the load and has known
memory leak. On the other hand, in 7.5.5 it produces rare records in the
output file (say, 100 per minute). It looks like it cannot match other
records, but this is weird, as they are all in the same format and happily
match in lognormalize.
Maybe I've just found why is this. Different output modules seem to be called
in parallel in 7.5.5, and mmnormalize adopts output module interface.
Therefore, if mmnormalize is faster than omfile, then omfile can see results
of mmnormalize. But it is very unlikely.
Am I right? Is parser module interface better for message modification
modules?
actions take place in the order they are listed in the config file, unless you
define queues for the different actions, in which case they just get copies to
the queues, then each queue operates independantly.
so if you put mmnormalize in something with it's own queue, only that queue will
see the modified message
There should never be a race condition between modules.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
