On 2/21/2018 11:23 PM, matthew.gaetano wrote:
Liblognorm is love, Liblognorm is life
To Echo Dave, $currentjob uses REK to provided services to various $client
at anywhere from 60-80k mps in realtime, plus spikes upwards of over 100k
mps. For redundancy (load balancing - waste not want not) we use two nodes
for the rsyslog but one node could easily handle the whole load. I cant get
that kind of vertical scalability with other tools; doing so often ends up
having farms of dozens of instances running (if not because of the load
itself, then because of the sequential regex parsing).
That is good info, thank you. I've heard others speak of how well
rsyslog handles heavy loads where other related tools tend to struggle
(or require significantly more resources). This is very encouraging.
It can take some getting use to writing Liblognorm rules but once you've
written a few you get the hang of it quickly; its not anymore effort than
learning Grok (Greylog, Logstash, regex fanatic product x). While it cant
always do everything more traditional regex based applications can, more so
highlighted as the more complicated you get, its worth the time effort
learning and using Liblognorm. Not only in rsyslog but in other applications
as well (I am currently using it NiFi).
I was wondering where else other than rsyslog that liblognorm was used.
Sounds like this is a case where others perhaps have just not heard
Liblognorm needs more users and more attention, I implore you to use it :)
Thanks for your feedback on this. Based on all of the recommendations
and good points shared, I will definitely invest the time to learn how
to use it.
rsyslog mailing list
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE