Actually, in this case the (limited) functionality will go into the core. But that's not because we need it for alerting but it is something that was scheduled for the core engine at all (because there are other use cases besides alerting where you need it, e.g. start some corrective action only after the n-th error indication). Plus, it will be very limited code. There are some other things, namely the enhanced rate limiter, which will go to the core. I have some ways to do that via plug-ins too, but given the expected complexity of this functionality vs the expected complexity of pluginizing them, the choice to go to core is really obvious. Another point where one could debate is enhanced queuing. This, in the long term, is a candidate for being moved to a plugin because many installations do never use disk-based (or assisted) queues.
Now comes the important difference: if a generic, any message let me know when it happens n times in the row filter would have been needed, that would NOT go into the core. Because it does not belong there. It is quite complex and even performance intense. For that, future version will have customer (RainerScript) functions which can be provided by library plugins. I have plans to implement such a beast (much later), but it will come as a function that you provide the message to and that is only loaded on an as-needed basis. I hope this clarifies. Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of (private) HKS > Sent: Friday, August 01, 2008 5:17 PM > To: rsyslog-users > Subject: Re: [rsyslog] Alert when multiple repeated lines are found > > Thanks for the link, that post makes a lot of sense. I interpreted > this discussion as moving towards adding alert functionality to the > rsyslogd core - but your stance of keeping the rsyslogd core lean and > efficient while plugins provide a full suite of event handling > processes is reassuring. > > I'm looking forward to seeing where you take this plugin architecture. > > -HKS > > On Fri, Aug 1, 2008 at 11:02 AM, Rainer Gerhards > <[EMAIL PROTECTED]> wrote: > > That's not a silly one ;) And it is coming up every now and then. The > > last time it came up, I was smart enough to write a blogpost: > > http://blog.gerhards.net/2008/03/on-rsyslog-design-philosophy- > plugins.ht > > ml > > > > In short, and to this questions: there are different schools of > thought. > > If you think about a plain ole syslogd shuffling data to disk files, > you > > do not need that. My vision of the syslogd (actually the "event > logging > > and alerting") subsystem is much broader. IMHO, it should support > > anything that is needed to gather, process and persistently store > > events. Also note that I say "events" for a reason - syslog messages > are > > just a subset of the potential set of events. > > > > Rainer > > > >> -----Original Message----- > >> From: [EMAIL PROTECTED] [mailto:rsyslog- > >> [EMAIL PROTECTED] On Behalf Of (private) HKS > >> Sent: Friday, August 01, 2008 4:25 PM > >> To: rsyslog-users > >> Subject: Re: [rsyslog] Alert when multiple repeated lines are found > >> > >> This may be a silly question, but is the syslog daemon the proper > >> place for something like this? > >> > >> -HKS > >> > >> On Fri, Aug 1, 2008 at 6:13 AM, Julian Yap <[EMAIL PROTECTED]> > >> wrote: > >> > Roger that Rainer. > >> > > >> > Thanks, > >> > Julian > >> > > >> > On Thu, Jul 31, 2008 at 11:58 PM, Rainer Gerhards > >> > <[EMAIL PROTECTED]> wrote: > >> >> OK, that greatly simplifies things. Actually, it now boils down > to > >> >> "execute an action only on the n-the time the filter evaluates to > >> true". > >> >> I think this is quite easy to implement, but I must verify > that... > >> >> > >> >> Rainer > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
