Thanks to both of you guys for your answers. FYI, our days have 24 hours in them :)
At this point I just got a config file worked up. I got the regexes working to do all of the matching I need into separate fields (the online regex tester was a big help), and upgraded to 5.6.0 (CentOS 5.5, in-house RPM build) in order to of bind imudp to a ruleset (so we can have one ruleset for localhost/unix socket, and one ruleset for all remote hosts). Unfortunately, I'm getting a segfault almost immediately on startup due to the following lines: $template RemoteHost,"/var/log/HOSTS/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogfacility-text%.log" *.* ?RemoteHost I believe I've narrowed the problem down to any templated (dynamic) filename... even if I dump everything external directly to /var/log/remote and add the following in my local ruleset: $template LocalHost,"/var/log/LOCAL/%syslogfacility-text%.log" *.* ?LocalHost I still get a segfault. The last line in the output running with -dn is always: "file to log to: RemoteHost" (or LocalHost, when I used that config). Has anyone seen anything like this? I have rsyslog 2.0.6 running at another site and dynamic filenames work fine... sort of troubling that 5.6.0 is having issues with them... Thanks, Jason Antman Aaron Wiebe wrote: >> 3) Assuming an even distribution over time (not quite accurate), any >> thoughts on how dumping ~2M lines/day of syslog to MySQL on a VM (Xen) >> with a single 2.8GHz CPU and 512MB RAM would go? >> > > 2 million lines a day is 70 lines per second assuming an 8 hour day. > MySQL, properly configured, will eat that. Rsyslog won't even notice > that log level. > > Your table sizes may be problematic over time, and your ability to > query may impact things. Regardless, your concern should be mysql, > not rsyslog. > > -Aaron > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
