i now note that my pstat loglines seem to be going through the 'main Q'.
i had thought that with the config (below) that they would just go through
the ruleset, with a separate q? what config bits am i missing here to
make that happen?
module(load="impstats" interval="15" bracketing="on" ruleset="pstats")
ruleset(name="pstats"){
action(type="omfile" name="pstatsout"
file="/var/log/pstatsout.log")
}
On 7/30/15, 16:36, "David Lang" <[email protected]> wrote:
>On Thu, 30 Jul 2015, Randall Diffenderfer wrote:
>
>> yes, the support of logrotate type file maintenance for "normal"
>>targets i
>> did note.
>>
>> i'm trying to figure out how big a hammer i need for the pstats output
>> file... :-)
>>
>> apparently a full restart is needed?
>
>yes, if you have pstats write to a file, a full restart is needed.
>
>what I do is:
>
>module(load="impstats" interval="60" resetCounters="on" format="legacy"
>ruleset="high_p")
>
># define a high priority queue that will send impstats immediately rather
># than going into the main queue and possibly being delayed by other logs
>ruleset(name="high_p" queue.type="FixedArray"){
> set $!trusted!local!input = $inputname;
> action(type="mmjsonparse")
> action(type="omfile" file="/var/log/pstats-local-messages"
>name="pstats_local")
> action(name="send_HP" type="omfwd" target="10.1.50.87" port="514"
>protocol="udp" template="structured_forwarding" queue.type="FixedArray")
>}
>
>
>This sends the pstats logs to a separate ruleset, with it's own queue, so
>it's
>completely independent of anything else that's going on.
>
>that ruleset can then write the logs out, and normal processing rules
>(including
>HUP) work for them.
>
>David Lang
>_______________________________________________
>rsyslog mailing list
>https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mail
>man_listinfo_rsyslog&d=BQICAg&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjh
>g&r=9sXs16LkSD1MzhoJxgyl7R_tait1dEXqvyD3NCT1wEA&m=MkaQPDo77NQdasL4zdGfbWI1
>biop-OghgOlGoZ2zJow&s=hd4SCKj1KXyVyEH6CWXIOdQtCR-U4wlHDpV2vklFtns&e=
>https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_profes
>sional-2Dservices_&d=BQICAg&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&
>r=9sXs16LkSD1MzhoJxgyl7R_tait1dEXqvyD3NCT1wEA&m=MkaQPDo77NQdasL4zdGfbWI1bi
>op-OghgOlGoZ2zJow&s=JBVCPMOYrO2bOV8qPdQUiE8g2NQ1leosFWGAlqiermY&e=
>What's up with rsyslog? Follow
>https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards
>&d=BQICAg&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=9sXs16LkSD1MzhoJ
>xgyl7R_tait1dEXqvyD3NCT1wEA&m=MkaQPDo77NQdasL4zdGfbWI1biop-OghgOlGoZ2zJow&
>s=r7oEXLPdcGCw0-DevU28492X_OzpVjKoSAruppqy7H4&e=
>NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
