On Tue, 19 Jan 2021, Matthias Sitte via rsyslog wrote:
This brings me to my questions: Is there a way to process a single syslog
messages in multiple rulesets (action chains) in parallel without affecting
each other? Is "call()" the right way to go, like use "call rs_siem; call
rs_rtmon" inside a ruleset rs_main?
If that isn't possible what would be the best alternative to achieve this?
From the top of my head I could think about sending each message twice for
the two rulesets rs_siem and rs_rtmon...
why do you need to process a single message in parallel rather than having two
worker threads working on different batches of messages at the same time?
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
