On Tue, 3 Jun 2014, Micah Yoder wrote:
Hi again,
Just wondering if there is any documentation for getting started to
hacking on the rsyslog code - structure descriptions, etc. There's some
in the code comments, but maybe a higher level description of key parts
would be nice.
Also, I'm having a hard time even finding the main() entry point ... :/
Not sure how much I'll do of this, but I'd like to have a better
understanding of how everything works, and be able to dig more into
issues like the TLS epoll thing I brought up a couple weeks ago.
(I'm conversant in C but wouldn't call myself an expert... prefer C++ :) )
unfortunantly there's not good documentation of how to get started hacking
(writing such documentation competes for Rainer's time with everything else)
I don't know how much you know, so the following may be covering territory you
already know.
In operation, the data flow is:
Input Modules (im*) receive bytestreams from the log sources and break them into
"messages"
This data is passed through Parser Modules [1] (pm*) that extract meaning from
the messages and create the various property fields
this data structure is passed to the main queue. This can be one of several
types of queue modules
no queue (direct)
fixed array in RAM
linked list in RAM
either of these with disk assist
disk-only
worker threads then come along and pick up messages from the main queue,
processes the rules from the config file, which do several things
1. flow control (apply filters to decide if the log matches this test). This
includes the "stop" function that skips processing any other config entries for
this log message
2. set variables
3. deliver to an action queue (at which point another worker thread processes it
from there.)
4. Message Modification (mm*) modules take the existing message structure,
modify it (usually by parsing it to extract more data into variables) and puts
the resulting message structure back on the queue
5. Output Modules (om*) modules take the message structure and use template
(which can be either a interpreted string or a String generation Module (sm*))
to craft output and deliver it.
[1] well, for most input modules, some do not go through the parser step
While there is a very significant core to rsyslog that drives all of this, the
vast majority of the ongoing work is in these modules.
I hope this provides a rough map of how rsyslog is organized, there are a lot of
example modules, and some non-example ones that are better ones to learn from
than others. Do you have questions about any particular area?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
