On Wed, 23 Nov 2016, Michael Biebl wrote:
Date: Wed, 23 Nov 2016 10:16:19 +0100
From: Michael Biebl <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Feedback request: minimal log shipper project
2016-11-22 18:14 GMT+01:00 David Lang <[email protected]>:
On Tue, 22 Nov 2016, Rainer Gerhards wrote:
The current packages are very granular. You don't gain much by
re-packaging, at least this is what I think. If I am wrong, I am all
ears, as it should be fairly easy to change that at least for the
project-provided packages.
The reasons I'm thinking of a diffeent package are:
1. compile out everything possible (let it use the rsyslog packages if the
rsyslog package is included and the config is changed to need them)
I think most distros already split out the modules. See the various
binary packages in Debian for example:
https://tracker.debian.org/pkg/rsyslog
So the core rsyslog package is already pretty lean (dependency and
footprint wise)
Well, the added packages are mostly for the modules that bring in other
dependencies
the base rsyslog module includes:
/usr/lib/x86_64-linux-gnu/rsyslog/imfile.so
/usr/lib/x86_64-linux-gnu/rsyslog/imjournal.so
/usr/lib/x86_64-linux-gnu/rsyslog/imklog.so
/usr/lib/x86_64-linux-gnu/rsyslog/imkmsg.so
/usr/lib/x86_64-linux-gnu/rsyslog/immark.so
/usr/lib/x86_64-linux-gnu/rsyslog/impstats.so
/usr/lib/x86_64-linux-gnu/rsyslog/imptcp.so
/usr/lib/x86_64-linux-gnu/rsyslog/imtcp.so
/usr/lib/x86_64-linux-gnu/rsyslog/imudp.so
/usr/lib/x86_64-linux-gnu/rsyslog/imuxsock.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmnet.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmnetstrms.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmnsd_ptcp.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmregexp.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmstrmsrv.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmtcpclt.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmtcpsrv.so
/usr/lib/x86_64-linux-gnu/rsyslog/lmzlibw.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmanon.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmexternal.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmjsonparse.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmnormalize.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmpstrucdata.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmsequence.so
/usr/lib/x86_64-linux-gnu/rsyslog/mmutf8fix.so
/usr/lib/x86_64-linux-gnu/rsyslog/omjournal.so
/usr/lib/x86_64-linux-gnu/rsyslog/ommail.so
/usr/lib/x86_64-linux-gnu/rsyslog/omprog.so
/usr/lib/x86_64-linux-gnu/rsyslog/omuxsock.so
/usr/lib/x86_64-linux-gnu/rsyslog/pmaixforwardedfrom.so
/usr/lib/x86_64-linux-gnu/rsyslog/pmcisconames.so
/usr/lib/x86_64-linux-gnu/rsyslog/pmlastmsg.so
/usr/lib/x86_64-linux-gnu/rsyslog/pmsnare.so
it may very well be that this is not significant. I'm just saying it's one thing
to look at.
2. change the default config file to something other than /etc/rsyslog.conf
3. include a very different default config file
4. changed binary name (something like logsend instead of rsyslogd)
I had requests in the past in Debian, to split out the default logging
rules into something like /etc/rsyslog.d/50-default.conf.
The default /etc/rsyslog.conf would then mostly be about sourcing
additional config from /etc/rsyslog.d/
Part of this is technical (what is small, efficient enough), part is learning
curve (how much work is it to set this up for someone who just wants a simple
thing done), and part of it is social engineering ("everyone knows rsyslog is
heavy and complex to setup, but logsend is easy")
There are only a few technical issues in making it work (the ability to add
sources easily), the rest is just thoughts in what would make it easy enough for
people to use it.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
