I don't have the time to check now, but it may be easier than it looks. I think we have pdag handles, which means we can easily load in the background and apply when ready. However, we need a rwlock to guard this operation (action level).
If it works that way, we could do it on HUP (for starters). Rainer 2016-12-21 17:37 GMT+01:00 David Lang <da...@lang.hm>: > I think the headache with doing this in liblognorm is the overhead that > can be there in reading/parsing/optimizing the ruleset. > > if you have multiple worker threads, having two of them hit the > mmnormalize action while one is rebuilding the ruleset leads to problems :-) > > what would be needed is for all existing parsing to continue to use the > old ruleset until the new ruleset is fully parsed, optimized, and ready for > use. > > We have a similar issue with the reload of a lookup_table and should be > able to use a similar solution. > > One complicating factor is that while a lookup_table has a global > existance and is something the rsyslog core knows about, mmnormalize > rulesets are handled only by the mmnormalize module code, and there's no > clean way to refer to a specific ruleset outside of that code. > > David Lang > > > On Wed, 21 Dec 2016, Benoit DOLEZ wrote: > > Yes, I think you are right about reloading only liblognorm. It's probably >> my first step. >> >> In most case I think we need a simple rainer-script if/then/else using a >> liblognorm app specific rule file. Then adding a new parser implies >> reloading rsyslog... >> >> Thank you for responses. I'm continuing to analyse source... >> >> Regards >> >> Benoit >> >> Le 21/12/2016 à 10:33, mostolog--- via rsyslog a écrit : >> >>> You may also find interesting to be able to reload liblognorm rules, >>> which might be an smaller change. >>> >>> The question here is the needed amount of work. >>> >>> >>> El 21/12/16 a las 10:29, Rainer Gerhards escribió: >>> >>>> Possible of course, but considerable work (gut feeling: 6+ strong >>>> weeks). >>>> >>>> Rainer >>>> >>>> Sent from phone, thus brief. >>>> >>>> Am 21.12.2016 09:42 schrieb "Benoit DOLEZ" <bdo...@pom-monitoring.com>: >>>> >>>> Hi >>>>> >>>>> I saw with previous posts that it seems to be complicated to reload >>>>> configuration; this is well explained here : >>>>> http://www.rsyslog.com/doc/v8-stable/compatibility/v4compati >>>>> bility.html#hup-processing. >>>>> >>>>> I wonder if the architecture of rulesets/queues could be flexible >>>>> enough >>>>> to implement a reload operation limited to rulesets. Do you think it is >>>>> possible to create new queues/rulesets/actions from a new config and >>>>> mark >>>>> the old ones for removal once idle/empty ? >>>>> >>>>> Regards >>>>> >>>>> Benoit >>>>> -- >>>>> Benoit DOLEZ, POM Monitoring, http://www.pom-monitoring.com/ >>>>> _______________________________________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com/professional-services/ >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> myriad >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >>>> if you DON'T LIKE THAT. >>>> >>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >> >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
