Hey David, and everyone else of course. thanks for your explanation of the dynamic buffer cache for file descriptors used in rsyslog, this makes a lot of sense now.
I can also follow entirely your description of the performance problem related to filenames keyed off timestamps. It strikes me though that you imply that these timestamps are "timereported" (i.e. the time of the log entry, according to the system on which the event took place), whereas I was under the impression that the filenames would be based on "timegenerated" (i.e. the time they are generated on the rsyslog server). While I can see the problem arising in the former case when clocks aren't synchronised, I was/am intending to use "system properties"¹, which are defined by the system running the generating rsyslog core. And in this case, once midnight comes, rsyslog won't ever need to write to yesterday's file ever again. ¹) http://www.rsyslog.com/doc/v8-stable/configuration/properties.html#system-properties So, template(name="fn_syslog" type="string" string="/var/log/%$now%-syslog") *.*;auth,authpriv.none -?fn_syslog should work fine, although it's a lot of boilerplate in the config file to do this for every log file. And then I'll augment this with a cronjob that runs shortly after midnight and maintains the symlink, e.g. /var/log/syslog → 2016-01-29-syslog It's somewhat of a hack, but it beats using logrotate, IMHO. Anyway, if anyone has any suggestions, e.g. how to reduce boilerplate (parametrisable templates would be great!), please don't hesitate! ;) -- @martinkrafft | http://madduck.net/ | http://two.sentenc.es/ there are lies, statistics, and benchmarks. spamtraps: [email protected]
digital_signature_gpg.asc
Description: Digital signature (see http://martin-krafft.net/gpg/sig-policy/999bbcc4/current)
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
