Thank you for the answer. As the rsyslog will feed Splunk (via log files) my target is to have performance, stability and in some degree redundancy. Since the devices will be network and the amount of events varies between sources (some are talkative other less) I don't want to have some blocks (so probably asynchronous process will needed). Currently in my setup I have: a main queue and a top level ruleset queue (in the one which have the call statements). All other rulesets (which are part of the call statement) they don't have something specific except the actions which are explicit "Direct". So I'm thinking if with this setup I will take the maximum (or at least the most of).
Regards, Alexandros -----Original Message----- From: Rainer Gerhards <[email protected]> Sent: Tuesday, May 26, 2020 4:28 PM To: rsyslog-users <[email protected]> Cc: Naoum, A. (Alexandros) <[email protected]> Subject: Re: [rsyslog] Queues efficient way Depends on what you want to do with the actions. Most important question: if one action blocks, shall all others block as well? If the answer is yes, then go for the queue at the ruleset level. As you know for omfile it almost always makes no sense to define a queue. Some for rulesets that contain only omfile actions. HTH Rainer El mar., 26 may. 2020 a las 16:19, Naoum, A. (Alexandros) via rsyslog (<[email protected]>) escribió: > > > Hi, > > Not sure if was asked before but I would like to ask what is the most > efficient way to add queues. > Scenario: > > Couple of rulesets with one action each ruleset to write to a file. > All of these ruleset are bind to one bigger one via call statement. The input > will be TCP mostly Excluding the actions which I read that it is better for > "omfile" to have Direct, where is better to add queues? > Main? Each ruleset? On the ruleset that have the call statement? All of them? > A combination? > > > Regards, > Alexandros > > This message (including any attachments) may contain confidential > information. It is intended for use by the recipient only. Any dissemination, > copying or distribution to third parties without the express consent of the > sender is strictly prohibited. If you have received this message in error, > please delete it immediately and notify the sender. Thank you for your > collaboration. > _______________________________________________ > rsyslog mailing list > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist > s.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=02%7C01%7Calexan > dros.naoum%40nn.cz%7C7afcc9778fae4a1c3c9b08d801811e10%7Cfed95e698d7343 > feaffba7d85ede36fb%7C1%7C0%7C637261001364523910&sdata=wmPbjaB6HJYj > hw8JEeVhPIYil8B18xt4yQTtU9FPLTk%3D&reserved=0 > https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.r > syslog.com%2Fprofessional-services%2F&data=02%7C01%7Calexandros.na > oum%40nn.cz%7C7afcc9778fae4a1c3c9b08d801811e10%7Cfed95e698d7343feaffba > 7d85ede36fb%7C1%7C0%7C637261001364523910&sdata=rY6Njpz04Q2Jjoklfyb > JrDYaLwqdhtOPcoNqXrwzy94%3D&reserved=0 > What's up with rsyslog? Follow > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwit > ter.com%2Frgerhards&data=02%7C01%7Calexandros.naoum%40nn.cz%7C7afc > c9778fae4a1c3c9b08d801811e10%7Cfed95e698d7343feaffba7d85ede36fb%7C1%7C > 0%7C637261001364533901&sdata=SJCQQIaUXLTFA%2BGJaEpoYmqt9bxjirsunft > wM3c3cAA%3D&reserved=0 NOTE WELL: This is a PUBLIC mailing list, > posts are ARCHIVED by a myriad of sites beyond our control. PLEASE > UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
