On Wed, Jan 27, 2016 at 6:07 PM, Michael Biebl <[email protected]> wrote:
> Another reason, why we don't use imjournal by default yet in Debian: > > I want a configuration which I can ship on all our architectures, > including non-Linux/non-systemd. > That is certainly a laudable goal. I'd like to know what you settle on and how that works out. > That's not possible if it involves imjournal. At least I don't know how. > Certainly imjournal is for systemd/journald so if your environment is heterogeneous and you want a homogeneous solution, that won't be the least common denominator. We are working on getting "collectors" for different environments and then normalizing in aggregators along the way to the central warehouse. We hope to keep the visualization/reporting and analysis tools as insulated as possible from the collection/aggregation side. -peter > > 2016-01-28 0:06 GMT+01:00 Michael Biebl <[email protected]>: > > 2016-01-27 23:37 GMT+01:00 Peter Portante <[email protected]>: > >>> As I can't look into the future, I'm just talking about the status-quo > >>> in Debian: > >>> We do install rsyslog by default in our current stable release > >>> (Jessie, aka 8.0) and that's still the case for testing/unstable. > >>> journald is setup to forward messages to rsyslog (aka. push model) > >> > >> > >> We use imjournal in fedora, rhel, centos, with systemd listening for > logs > >> on /dev/log and then rsyslog pulling them. > > > > imjournal only works halfway decently if you have a persistent > > journal. As I mentioned, we don't use persistent journal in Debian > > (for one, to avoid writing log messages to disk twice). > > > > imjournal did also have quite some serious bugs in the past (like > > getting stuck in a loop generating a flood of log messages filling up > > the disk). So I'm not yet comfortable enabling that. Especially since > > there is no official *upstream* support for imjournal. > > > > I also wonder, what the performance overhead is for imjournal. I > > suspect that the throughput using > > ForwardToSyslog=yes is higher. If anyone has benchmarks for that, I'd > > appreciate that. > I'd like to collaborate on that with folks, for those interested. I have access to two socket westmere class boxes, 48 GB of memory, so we could put together a fair level of testing in such an environment. -peter > > > > Michael > > > > > > -- > > Why is it that all of the instruments seeking intelligent life in the > > universe are pointed away from Earth? > > > > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
