why add the overhead of transporting the data between machines if you
don't need to? Rsyslog is FAST, it routinely does things on one
machine that other systems need many farms of machines to do.
adding more machines and network connectivity will add complexity and
delays, reducing performance and reliability
Ok!
that depends how you configure it. All queues can be configured to
operate in multiple modes
Ok. I forgot the main queue can be configured too!
there are three stages in decoding a message
1. the framing of a message (i.e. UDP a packet is a message, TCP
newline indicates the end of a message)
2. the parsing of the message. The syslog format is a header followed
by arbitrary text. This step is decoding the header
note: many log installations don't do anything more than this.
3. parsing the free-form text message, i.e. 'normalizing' the logs
I've made the suggestion in the past that we create a pmnormalize that
uses liblognorm rules against the raw message and can populate the
standard properties, but it hasn't been a high priority (the overhead
of parsing the data with an existing parser and then dealing with it
with mmnormalize just isn't very high)
I'm somehow with you on this. I didn't like my messages being "parsed"
by default RFCs (hence, splitting json)
I understand rsyslog was born to handle logs (and their lack of
standards), but I wouldn't forget it's also message-shipper, hence it
could make sense to convert pm to mm and to define the pipeline as I
exposed before.
The devil is in the details, and when you are working to make things
very fast, it gets messy.
I deliberatly simplified a bunch of things to give you the architecture.
You need to first think about what is it that you are trying to
understand when looking at the code.
Although I have progressed a bit since the beginning, it stills causes
me some headaches.
If you want to deal with a logsource that can't comply with the very
simple syslog protocol, you need a pm module. This is mostly for
things like Cisco adding a field to the messae, AIX adding "message
forwarded from", etc (we actually could use one that deals with
syslog-ng inserting the severity in the header)
again, IMHO, using pm and mm doesn't make much sense. They could be,
both, sequential actions.
to do the imhiredis module, the biggest issue is someone with a really
good understanding of how redis works and the over-the-wire protocol
Bob!
I have played a bit with Redis, and doesn't seem very complex (rsyslog
neither...and look!!!)
Thanks a lot for your kind help
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
