Hello David, thank you for pointing to the RSYSLOG_DebugFormat. One test message showed me this:
Debug line with all properties: FROMHOST: 'server', fromhost-ip: '127.0.0.1', HOSTNAME: 'server', PRI: 46, syslogtag 'rsyslogd:', programname: 'rsyslogd', APP-NAME: 'rsyslogd', PROCID: '-', MSGID: '-', TIMESTAMP: 'Apr 6 10:45:05', STRUCTURED-DATA: '-', msg: ' [origin software="rsyslogd" swVersion="8.15.0" x-pid="2957" x-info="http://www.rsyslog.com";] start' escaped msg: ' [origin software="rsyslogd" swVersion="8.15.0" x-pid="2957" x-info="http://www.rsyslog.com";] start' inputname: rsyslogd rawmsg: ' [origin software="rsyslogd" swVersion="8.15.0" x-pid="2957" x-info="http://www.rsyslog.com";] start' $!: $.: $/: Does this mean the message is in memory in three copies - as 'msg', 'escaped msg' and 'rawmsg'? Does the whole debug line provide the memory footprint or do I have to count the message size overhead with value-name strings only "FROMHOST: , fromhost-ip: , HOSTNAME: , PRI: , syslogtag, programname: , APP-NAME: , PROCID: , MSGID: , TIMESTAMP: , STRUCTURED-DATA: ...."? Or in any other way? In case the whole debug line is equal to the message size in memory, the message of 162B consume 602B in memory. Is that right? -- Peter On Wed, Apr 5, 2017 at 11:11 PM, David Lang <[email protected]> wrote: > On Wed, 5 Apr 2017, Peter Viskup via rsyslog wrote: > > > it's not message_size, it's message size + decoded data size, log a message > with RSYSLOG_DebugFormat and you can see all the data that's part of the > queued message. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
