On Wed, 28 Dec 2016, mostolog--- via rsyslog wrote:
Even more: does it make sense to have queues when using omfile?
usually not, it's usually less effort to write the data to the file than to move
it to a new queue.
You want a queue on an output (or on a ruleset with multiple outputs) if you
think there can be problems with an output (either that it can't keep up with
peak load, or that it may fail entirely for some time[1]) and you want to me
sure that you can keep processing logs to other outputs
imfile keeps track of where it is, so if it can't process messages, none are
lost[2], so you may not need a queue if your only source is imfile.
The other reason for having a queue involved is to allow batching of messages.
There are a lot of cases where it is far more efficient to process multiple
messages at a time instead of one at a time.
For example, RELP can send multiple messages while waiting for acks for the
first message sent and so will operate much faster if it has a queue of multiple
messages available to send then if it must wait for the ack for each message
before starting to send the next message.
Another example, I've measured databases where inserting 1000 messages as a
batch took the same time as inserting 2 messages independently.
As a general rule, you will want to have a queue on anything that sends to a
network/remote system, and may want to have a queue on sending to complex
servers on local systems (i.e. databases) so that you can keep accepting new
messages when the destinations are slow or unavailable.
But to have a queue on omfile is seldom appropriate because if you do have a
problem that prevents the log from being written, you are unlikely to be able to
do anything else anyway.
David Lang
[1] network outages, remote systems being rebooted, etc
[2] except in the case where you have file rotations going on and multiple
rotations happen while you are stopped
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
