[rsyslog] heavy load for distributed rsyslog

[senaps via rsyslog]

hello there,

i have a very large network appliance writing over 10-12000 log lines per
second, and now im tasked to distribute the system, but this means i should
have a device
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Are configuration parameters case sensitive?

[Rainer Gerhards]

2017-11-17 18:13 GMT+01:00 deoren
:
> On 11/17/2017 11:05 AM, Rainer Gerhards wrote:
>>
>> 2017-11-17 18:04 GMT+01:00 deoren
>> :
>>>
>>> I noticed this commit focused on fixing the case in the source code for
>>> comparison purposes:
>>>
>>>
>>> https://github.com/rgerhards/rsyslog/commit/b9cda4602b26a4778fdfec4990a62b6faf2bc86b
>>>
>>> which leads me to ask:
>>>
>>> Are configuration parameters case sensitive?
>>
>>
>> no - but internally, this is done by converting them to lower case.
>> The PR fixes mixed case in the param definition, which will never
>> match the lower-case only param from the config.
>>
>> HTH
>> Rainer
>
>
> Thanks! I opened an issue in the rsyslog-doc project re this. I'll try to
> make time to review the docs soon and submit a PR that helps to emphasize
> this.
>
> I wouldn't be surprised if the docs already mention this in several places
> and I just overlooked it. If so, I'll just close out the ticket, otherwise
> I'll submit a PR that includes additional references to this fact to help
> emphasize it.

thanks for the great work! Folks will be very, very happy when someone
is getting the doc in better shape. It really needs this. Very, very
valuable work! (Y)

Rainer
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Are configuration parameters case sensitive?

[deoren]

On 11/17/2017 11:05 AM, Rainer Gerhards wrote:

2017-11-17 18:04 GMT+01:00 deoren
:

I noticed this commit focused on fixing the case in the source code for
comparison purposes:

https://github.com/rgerhards/rsyslog/commit/b9cda4602b26a4778fdfec4990a62b6faf2bc86b

which leads me to ask:

Are configuration parameters case sensitive?


no - but internally, this is done by converting them to lower case.
The PR fixes mixed case in the param definition, which will never
match the lower-case only param from the config.

HTH
Rainer


Thanks! I opened an issue in the rsyslog-doc project re this. I'll try 
to make time to review the docs soon and submit a PR that helps to 
emphasize this.


I wouldn't be surprised if the docs already mention this in several 
places and I just overlooked it. If so, I'll just close out the ticket, 
otherwise I'll submit a PR that includes additional references to this 
fact to help emphasize it.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Are configuration parameters case sensitive?

[Rainer Gerhards]

2017-11-17 18:04 GMT+01:00 deoren
:
> I noticed this commit focused on fixing the case in the source code for
> comparison purposes:
>
> https://github.com/rgerhards/rsyslog/commit/b9cda4602b26a4778fdfec4990a62b6faf2bc86b
>
> which leads me to ask:
>
> Are configuration parameters case sensitive?

no - but internally, this is done by converting them to lower case.
The PR fixes mixed case in the param definition, which will never
match the lower-case only param from the config.

HTH
Rainer
>
> For example, are these all equivalent?
>
> global (
> ...
> maxMessageSize="128k"
> ...
> )
>
>
> global (
> ...
> MaxMessageSize="128k"
> ...
> )
>
> global (
> ...
> maxmessagesize="128k"
> ...
> )
>
> Thanks.
>
> P.S.
>
> I looked briefly at the documentation[1], but I didn't spot anything
> conclusive.
>
> [1] http://www.rsyslog.com/doc/v8-stable/configuration/basic_structure.html
> ___
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

[rsyslog] Are configuration parameters case sensitive?

[deoren]

I noticed this commit focused on fixing the case in the source code for 
comparison purposes:


https://github.com/rgerhards/rsyslog/commit/b9cda4602b26a4778fdfec4990a62b6faf2bc86b

which leads me to ask:

Are configuration parameters case sensitive?

For example, are these all equivalent?

global (
...
maxMessageSize="128k"
...
)


global (
...
MaxMessageSize="128k"
...
)

global (
...
maxmessagesize="128k"
...
)

Thanks.

P.S.

I looked briefly at the documentation[1], but I didn't spot anything 
conclusive.


[1] http://www.rsyslog.com/doc/v8-stable/configuration/basic_structure.html
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Updates 8.29 -> 8.30 broke several logs

[Rainer Gerhards]

Mike,

Florian has created a new 8.30.0.2 package. It's not actually like I
would like to have it, but at least it contains what you need to check
the imjournal issue.

Rainer

2017-11-13 16:12 GMT+01:00 Rainer Gerhards :
> will come this week
>
> 2017-11-13 15:56 GMT+01:00 Mike Schleif :
>> Rainer,
>>
>> Please, advise status. Thank you.
>>
>> On Mon, Nov 6, 2017 at 8:57 AM, Rainer Gerhards 
>> wrote:
>>
>>> thanks for following up!
>>>
>>> 2017-11-06 15:54 GMT+01:00 Mike Schleif :
>>> > Rainer,
>>> >
>>> > I see that you closed #1895 yesterday.
>>> >
>>> > Does this mean that there is something for us to test now?
>>>
>>> Yup. FYI: I closed because I think it is fixed and keeping the PR open
>>> any longer causes grief with CI integration. Too many changes going on
>>> in parallel. If it doesn't work out, we can fix anyway.
>>> >
>>> > Where is it?
>>>
>>> Not yet ready. There is a backlog from last week which we need to work
>>> on. I'll let you know when it is ready. I'd guess tomorrow or
>>> Wednesday, based on discussion this morning. Let's then see if it
>>> really solves the problem for you - I guess so but would like to have
>>> proof.
>>>
>>> Rainer
>>> >
>>> > Please, advise. Thank you.
>>> >
>>> > ~ Mike
>>> >
>>> >
>>> >
>>> > On Fri, Oct 27, 2017 at 10:48 AM, Rainer Gerhards <
>>> rgerha...@hq.adiscon.com>
>>> > wrote:
>>> >
>>> >> 2017-10-27 17:32 GMT+02:00 Mike Schleif :
>>> >> > Rainer,
>>> >> >
>>> >> > I'd much prefer if you can build the test RPM, like was done for
>>> >> 8.30.0.1.
>>> >> > This is a critical Production host, and it's not easy scheduling it
>>> for
>>> >> > multiple reboots. That, and I'm rather rusty at compiling right the
>>> first
>>> >> > time ...;-)
>>> >>
>>> >> No problem, but it'lk probably take a week or so (next week is a
>>> >> mega-public holiay week over here in Germany and we have thight
>>> >> ressources). I'd also like to fully complete the patch before going
>>> >> through a package build.
>>> >>
>>> >> Please also subscribe to the issue tracker if you have not yet done.
>>> >> When it is closed, you know it is merged - just in case I forget to
>>> >> notify via this mail.
>>> >>
>>> >> Thx,
>>> >> Rainer
>>> >> >
>>> >> > ~ Mike
>>> >> >
>>> >> >
>>> >> > On Fri, Oct 27, 2017 at 9:56 AM, Rainer Gerhards <
>>> >> rgerha...@hq.adiscon.com>
>>> >> > wrote:
>>> >> >
>>> >> >> I think we have a fix now. It's already mentioned in the GitHub issue
>>> >> >> tracker. Can you build from source and try it?
>>> >> >>
>>> >> >> Rainer
>>> >> >>
>>> >> >> Sent from phone, thus brief.
>>> >> >>
>>> >> >> Am 27.10.2017 16:46 schrieb "Mike Schleif" <
>>> >> mike+rsys...@mdsresource.net>:
>>> >> >>
>>> >> >> > Rainer,
>>> >> >> >
>>> >> >> > Please, advise status. Thank you.
>>> >> >> >
>>> >> >> > ~ Mike
>>> >> >> >
>>> >> >> >
>>> >> >> > On Tue, Oct 24, 2017 at 9:10 AM, Rainer Gerhards <
>>> >> >> rgerha...@hq.adiscon.com
>>> >> >> > >
>>> >> >> > wrote:
>>> >> >> >
>>> >> >> > > ok, thanks, we are getting closer:
>>> >> >> > >
>>> >> >> > > https://github.com/rsyslog/rsyslog/issues/1895
>>> >> >> > >
>>> >> >> > > While the question is why it get's an error in the first place,
>>> >> >> > > imjournal should definitely handle the situation more gracefully.
>>> >> Need
>>> >> >> > > to think/code and then need you to apply another test build.
>>> >> >> > >
>>> >> >> > > Rainer
>>>
>>
>>  
>> ___
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
>> LIKE THAT.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.