On Fri, Oct 25, 2013 at 1:37 PM, Boylan, James <[email protected]>wrote:
> Well. I'll let it run for a while in my staging environment but I'm > seeing, even with some nested field() calls, an overall drop in average per > instance CPU utilization of almost half. That is definitely a huge > improvement. > > interesting... I was concerned about the multiple substring creation. Rainer > I'll post more as the test runs. > > -- James > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Rainer Gerhards > Sent: Friday, October 25, 2013 6:08 AM > To: rsyslog-users > Subject: Re: [rsyslog] Performance question. > > On Fri, Oct 25, 2013 at 1:02 PM, Boylan, James <[email protected] > >wrote: > > > Quick Question. Which is more impactful to performance? > > > > set $!session = re_extract($msg, > > '^.*[\\^][0-9.-]+\\|[A-Z]+\\|[a-zA-Z0-9.-]+\\|[a-zA-Z0-9._-]+\\|[a-zA- > > Z0-9]*\\|([a-zA-Z0-9._-]*)[~]*[a-zA-Z0-9._-]*\\|.*', > > 0, 1, 'N/A'); > > > > or > > > > set $!session = field(field(field($msg, 94, 2), 124, 6), 126, 1); > > > > I'm going to do some testing, but if I can get a quick response here > > it could save me some time. I would expect the re_extract function to > > be, but I'm not familiar with how the code for field works so I can't > > make that assumption. > > > > > That's my assumption as well, but I may be wrong. > > Rainer > > > Thanks! > > > > -- James > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
