Re: [rsyslog] foreach in json array got segment fault?

2015-03-31 Thread Rainer Gerhards
2015-03-30 19:55 GMT+02:00 singh.janmejay singh.janme...@gmail.com: Sorry, I haven't had a chance to look at it yet. Take your time, I know how challenging it is at times ;) I just wanted to spread the good news that we have a good repro. Rainer Will get to this asap. On Mon, Mar 30, 2015

Re: [rsyslog] omprog should forward signals to the binary

2015-03-31 Thread Rainer Gerhards
2015-03-31 1:25 GMT+02:00 David Lang da...@lang.hm: On Wed, 25 Mar 2015, Rainer Gerhards wrote: 2015-03-25 12:06 GMT+01:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-25 11:49 GMT+01:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-24 23:22 GMT+01:00 David Lang da...@lang.hm:

[rsyslog] rsyslog and GnuTLS

2015-03-31 Thread jone...@teksavvy.com
Hello, Does rsyslog have any role at all in specifying which ciphers and algorithms to use when doing remote logging through a secure connection, or is that taken care of transparently by the GnuTLS library ? Regards. ___ rsyslog mailing list

[rsyslog] Queues $ActionExecOnlyWhenPreviousIsSuspended

2015-03-31 Thread Tomas Heinrich
Hello, I've been playing with failover of multiple actions and discovered that this feature behaves strangely in combination with queues. To test, I use this simple snippet: #$ActionQueueType LinkedList *.* @@localhost:1234 $ActionExecOnlyWhenPreviousIsSuspended on #$ActionQueueType

Re: [rsyslog] Separation of actions based on log source - with good performance

2015-03-31 Thread Christopher . Racky
Hi, Do you have some experience how large Lookup-tables can be until there are negative effects? 2400 entries seems to work fine :) And another question, do I loose events, when doing a kill -HUP (for update of lookup-table)? (e.g. client threads are hard terminated...) best regards Chris  

Re: [rsyslog] omprog should forward signals to the binary

2015-03-31 Thread Rainer Gerhards
2015-03-31 12:27 GMT+02:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-31 1:25 GMT+02:00 David Lang da...@lang.hm: On Wed, 25 Mar 2015, Rainer Gerhards wrote: 2015-03-25 12:06 GMT+01:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-25 11:49 GMT+01:00 Rainer Gerhards

Re: [rsyslog] Queues $ActionExecOnlyWhenPreviousIsSuspended

2015-03-31 Thread Rainer Gerhards
2015-03-31 14:01 GMT+02:00 Tomas Heinrich thein...@redhat.com: Hello, I've been playing with failover of multiple actions and discovered that this feature behaves strangely in combination with queues. To test, I use this simple snippet: #$ActionQueueType LinkedList *.* @@localhost:1234

Re: [rsyslog] Rsyslog hang causing issues with unwritable /dev/log

2015-03-31 Thread Peter Viskup
Let me answer myself: http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html stating: The $ActionQueueFileName is used to create queue files, should need arise. This value must be unique inside rsyslog.conf. No two rules must use the same queue file. ...then config example of forwarding to

Re: [rsyslog] Rsyslog hang causing issues with unwritable /dev/log

2015-03-31 Thread Peter Viskup
Hi David, yes was on the way to read that documentation and it definitely helped me to understand the rsyslog queues which is important to have it setup properly. Would be probably good to include some of the options in the default config file just to make them visible and with some link to that

Re: [rsyslog] Queues $ActionExecOnlyWhenPreviousIsSuspended

2015-03-31 Thread Tomas Heinrich
On 03/31/15 15:49, Rainer Gerhards wrote: That's because the presence of a queue triggers async behaviour: On submit to the action queue, the message is duplicated and processed in parallel (probably much later) to the original message. That parallel / async processing is the core reason you

Re: [rsyslog] Separation of actions based on log source - with good performance

2015-03-31 Thread Rainer Gerhards
2015-03-31 15:46 GMT+02:00 christopher.ra...@web.de: Hi, Do you have some experience how large Lookup-tables can be until there are negative effects? 2400 entries seems to work fine :) IIRC the current partial implementation is O(log n), so no problem. And another question, do I loose

Re: [rsyslog] Rsyslog hang causing issues with unwritable /dev/log

2015-03-31 Thread David Lang
all the queue configuration vanishes as soon as an action is defined, nothing persists to future actions. This is one of the places where you _really_ want to be running a current version. The new style config is so much clearer as to what's going on than the legacy style. This is why the new

Re: [rsyslog] Queues $ActionExecOnlyWhenPreviousIsSuspended

2015-03-31 Thread David Lang
On Tue, 31 Mar 2015, Tomas Heinrich wrote: On 03/31/15 15:49, Rainer Gerhards wrote: That's because the presence of a queue triggers async behaviour: On submit to the action queue, the message is duplicated and processed in parallel (probably much later) to the original message. That parallel

Re: [rsyslog] Sending file to remote rsyslog server

2015-03-31 Thread Bautista, Ramon
I would need to get approval before updating the rsyslog for some of our prod servers. I may ask the guys to just add it to part of their monthly patching. I know a few emails ago you brought up the fact the rsyslog monitors multiple files in the rsyslog.conf at the same time. Could you expand

Re: [rsyslog] omprog should forward signals to the binary

2015-03-31 Thread David Lang
On Tue, 31 Mar 2015, Rainer Gerhards wrote: 2015-03-31 12:27 GMT+02:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-31 1:25 GMT+02:00 David Lang da...@lang.hm: On Wed, 25 Mar 2015, Rainer Gerhards wrote: 2015-03-25 12:06 GMT+01:00 Rainer Gerhards rgerha...@hq.adiscon.com: 2015-03-25