I think the headache with doing this in liblognorm is the overhead that can be
there in reading/parsing/optimizing the ruleset.
if you have multiple worker threads, having two of them hit the mmnormalize
action while one is rebuilding the ruleset leads to problems :-)
what would be needed is for all existing parsing to continue to use the old
ruleset until the new ruleset is fully parsed, optimized, and ready for use.
We have a similar issue with the reload of a lookup_table and should be able to
use a similar solution.
One complicating factor is that while a lookup_table has a global existance and
is something the rsyslog core knows about, mmnormalize rulesets are handled only
by the mmnormalize module code, and there's no clean way to refer to a specific
ruleset outside of that code.
David Lang
On Wed, 21 Dec 2016, Benoit DOLEZ wrote:
Yes, I think you are right about reloading only liblognorm. It's probably my
first step.
In most case I think we need a simple rainer-script if/then/else using a
liblognorm app specific rule file. Then adding a new parser implies reloading
rsyslog...
Thank you for responses. I'm continuing to analyse source...
Regards
Benoit
Le 21/12/2016 à 10:33, mostolog--- via rsyslog a écrit :
You may also find interesting to be able to reload liblognorm rules,
which might be an smaller change.
The question here is the needed amount of work.
El 21/12/16 a las 10:29, Rainer Gerhards escribió:
Possible of course, but considerable work (gut feeling: 6+ strong weeks).
Rainer
Sent from phone, thus brief.
Am 21.12.2016 09:42 schrieb "Benoit DOLEZ" <[email protected]>:
Hi
I saw with previous posts that it seems to be complicated to reload
configuration; this is well explained here :
http://www.rsyslog.com/doc/v8-stable/compatibility/v4compati
bility.html#hup-processing.
I wonder if the architecture of rulesets/queues could be flexible enough
to implement a reload operation limited to rulesets. Do you think it is
possible to create new queues/rulesets/actions from a new config and
mark
the old ones for removal once idle/empty ?
Regards
Benoit
--
Benoit DOLEZ, POM Monitoring, http://www.pom-monitoring.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
