Hi, I think I need to make my thoughts clear regarding the flexibility topic, because I saw the same position by Otis and I saw some reactions to my earlier Email.
Let's imagine logging tools are cars. Rsyslog seems to be one that's resource-efficient (light) and has a good top speed (fast). Handling (configuration) is not that easy and all-terrain abilities (adding new modules) are also difficult. Those two things are the flexibility I was talking about. My journal + mongodb example was intentionally chosen as something that rsyslog *can* do, but it's not that easy. We can look at the causes: documentation is far from where we want it, names like "imuxsock" or "mmnormalize" are far from being intuitive. In car terms, this is what I mean by "handling is difficult": it can take a turn, but requires some skill. Writing a new module is possible, or course, but again: documentation can be more detailed and writing this C code is nowhere near as easy as, say, Ruby. In car terms, this is what I mean by "all terrain ability": it can go on some gravel, but I wouldn't cross a river with it. Can we improve on flexibility? Of course we can and it's a good thing to do. If a car can't take a turn without flipping over it's useless and if it can only go on track only a handful of people will buy it. But we can't take a Ferrari and make it a VW Touareg. We can improve it in lots of ways, make it handle better (improve docs) or even add 4-wheel drive (improve omprog, add more modules) but ultimately there are some design decisions that limit how far we [want to] go in that direction, especially when there are good SUVs out there on one hand and people need what rsyslog offers on the other. Making rsyslog (more) flexible by helping users configure and extend it easier is definitely something that we should do. But making it a mission (ie: a top priority) out of this? I think it's not credible, nor is it realistic. I'd rather rsyslog as a tool that's light, fast and reliable (mission!) and that can also do a lot of stuff. Like a McLaren F1: can still smoke supercars after 25 years, with a couple of buddies and their backpacks on-board. Its mission was to be the ultimate driver's car, and not to be a usable/flexible grand-tourer. Flexibility comes in as P2, and it's important so you can actually use the thing. I hope I didn't bore you with my comparison, I tried my best to make myself clear. On the upside, the designer guy I talked to gave me the first logo. I'll post it on a different thread. Best regards, Radu 2014/1/21 Rainer Gerhards <[email protected]> > Sorry folks, i had some very time critical things on my agenda... i > overlooked a dependency ;) will rejoin this great discussion tomorrow. > Just so that you know i am very interested. Actually, its kind of a > reality check for me. Flexibility was always high on ny agenda, it probably > has slipped for performance without me noticing. I'd like to get most of > both. Maybe with the upcoming non-c interface... > > Keep the thoughts flowing! > > Rainer > > Sent from phone, thus brief. > Am 21.01.2014 19:35 schrieb "Dave Caplinger" < > [email protected] > >: > > > On Jan 20, 2014, at 4:24 PM, David Lang <[email protected]> wrote: > > > > > On Mon, 20 Jan 2014, Radu Gheorghe wrote: > > > > > >> I'm not saying rsyslog shouldn't do flexibility. I think it's > > uberimportant > > >> and it's worth investing in. I'm saying we should go with one of the > > >> directions where rsyslog is pushed to that: > > >> - is already partially accomplished (so it's credible) > > >> - has the potential to go > > >> - last but not least, where we want it to go :) > > >> > > >> I thought something that includes the words fast, light and processing > > will > > >> do, given the history of rsyslog and where it seems to go now with v8. > > > > > > I see rsyslog as being the core of a logging system, it gathers logs > from > > > (almost) anything, and delivers them to (almost) anything. It can > modify > > and > > > filter the messages along the way. > > > > This is similar to my own "customer testimonial." The three main reasons > I > > switched to rsyslog are: > > > > 1) Much higher performance. > > 2) It has DAQ, detailed pstats, TLS, RELP, and now log-signing support so > > it's reliable in the sense that logs that get in are not going to get > lost > > someplace mysteriously. (Even drops outside your control become > > manageable/correctable.) > > 3) Property replacement, JSON, and filtering, allow you to modify and > > route logs as you like. > > > > Going with the R-theme (since 'R' initially meant Reliable) that gives > me: > > > > * Reliable > > * Rapid > > * Routing > > > > (Back to the logo: borrowing from another of Rainer's interests that I > > happen to share, maybe R is for Rocket [with apologies to Ray Bradbury].) > > > > Contrast this with logstash, which is extremely flexible: it can connect > > just about any input to just about any output, like pipe/grep/awk/etc. > for > > log streams. It's a "log format translator", but not necessarily a > > high-performance "log router". > > > > - Dave > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
