you always have a main message queue, you only have an action queue if you
explicitly configure it.
In my tests, fixedarray was slightly faster than linkedlist and the memory
issues were really not relevant (you have to size for full queues anyway, so the
fact that linkedlist uses slightly less ram when the queues are empty doesn't
really make much differenct)
you should add action queues (or with a current version, action queues on
rulesets) when you have actions that may block due to factors that are different
from your other actions (typically network/remote server issues)
since having action queues means that messages get duplicated into the action
queues, having a lot of them is really bad for memory usage when things go
wrong. This is why it's frequently the right thing to put the queue on a ruleset
that contains multiple actions rather than on each action individually.
David Lang
On Thu, 27 Apr 2017, Singh, Radesh wrote:
Date: Thu, 27 Apr 2017 17:39:14 +0000
From: "Singh, Radesh" <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] FixedArray vs LinkedList
Thanks Rainer!
So, our ObjectType is LinkedList...
What got us going down this path is we expect to increase logging fairly
significantly.
At first I thought our question was FixedArray vs LinkedList, as I assumed
FixedArray would have been the default (wrong).
Now that I understand LinkedList to be the default, I wonder if we should be
using a main message queue, or action message queues.
If not specified, is there a default?
Is this where the stuff in our rsyslog.d/*.conf comes into play?
R. Singh
Sr. Systems Administrator I
Middleware (PTC)/CSX Technology
904-633-5745
RC Offering: SC07507098
For which of you, intending to build a tower, sitteth not down first, and
counteth the cost, whether he have sufficient to finish it? - Luke 14:28 (AKJV)
-----Original Message-----
From: rsyslog [mailto:[email protected]] On Behalf Of Rainer
Gerhards
Sent: Thursday, April 27, 2017 1:00 PM
To: rsyslog-users
Subject: Re: [rsyslog] FixedArray vs LinkedList
2017-04-27 18:50 GMT+02:00 Singh, Radesh <[email protected]>:
Hello,
I'm running an old version of rsyslog (rsyslog 5.8.10-10.el6_6) on RHEL 6.7.
We've discussed switching from FixedArray, which I believe to be in use on the
server, to using LinkedList.
Looking over our configuration, I don't see where we specify the queuetype.
If not specified, what is the default for 5.8.10?
Here is our config... comments and empty lines stripped out...
$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command) $SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0 $IMUxSockRateLimitBurst 0
$IMUXSockRateLimitBurst 0 $IMUxSockRateLimitSeverity 7
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
The files in rsyslog.d don't have any queue type statements in them.
The default is linkedList.
Rainer
Thank you for your help.
Shawn
"After all, there can be no leadership where there is no team." - J.
Willink, L. Babin
This email transmission and any accompanying attachments may contain CSX
privileged and confidential information intended only for the use of the
intended addressee. Any dissemination, distribution, copying or action taken in
reliance on the contents of this email by anyone other than the intended
recipient is strictly prohibited. If you have received this email in error
please immediately delete it and notify sender at the above CSX email address.
Sender and CSX accept no liability for any damage caused directly or indirectly
by receipt of this email.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://secure-web.cisco.com/1sxJvkmE1G7tJ0l9b5IOQtDR9v63uTYhHdEGC5hVae
hXQqJUUsWedW5v_U0Nk5ROKE-vFQn3nZP00zdUwQhaHq9sBlPaziZVLFXUnx1h05-QVlAT
WJ6NLE4fLuF2lnOfiLLWzCic0c0KSUCiRZa5CjrWiM3fsJPqgUKdx2vCCGO7xs3DgUT9D2
jt6PvwSeMtOpLipkC7z4wEO7A7_shjl1Houl8Q8cpJ9OBDgLs9qnqxWgwy3re4d3jWBXW9
Hcj9PBk1TpKTT4MNbesWgvOfzSPLM3Q9qnycH4EYOsOhVkW-_OLLXRYkiV-1gdIRm2IY4i
qwjWTpW6kka1tw1xs_m5Nd16LrczdxneFAdkjDybdMTAUD_Nt2FpDUj58mzYzsV/http%3
A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://secure-web.cisco.com/1sxJvkmE1G7tJ0l9b5IOQtDR9v63uTYhHdEGC5hVaehXQqJUUsWedW5v_U0Nk5ROKE-vFQn3nZP00zdUwQhaHq9sBlPaziZVLFXUnx1h05-QVlATWJ6NLE4fLuF2lnOfiLLWzCic0c0KSUCiRZa5CjrWiM3fsJPqgUKdx2vCCGO7xs3DgUT9D2jt6PvwSeMtOpLipkC7z4wEO7A7_shjl1Houl8Q8cpJ9OBDgLs9qnqxWgwy3re4d3jWBXW9Hcj9PBk1TpKTT4MNbesWgvOfzSPLM3Q9qnycH4EYOsOhVkW-_OLLXRYkiV-1gdIRm2IY4iqwjWTpW6kka1tw1xs_m5Nd16LrczdxneFAdkjDybdMTAUD_Nt2FpDUj58mzYzsV/http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
