On Thu, 2 May 2013, Balamurugan Arumugam wrote:
I didn't pay close enough attention. You want to have a message counter.
Therfore you need global variables. They are not available yet. I did not
implement them as I was/am very curios if they are actually needed. What's
the use case behind this request?
I feel it will be very useful. My use case is, alert user by email,snmp etc
on basis of message count per severity/facility. For example, raise snmp trap
of every 10th critical messages, every 50th send mail to admin, on every 100th
alert manager and reset the count etc.
This is the sort of thing I would use SEC for (Simple Event Correlator,
http://simple-evcorr.sourceforge.net/ )
the problem is that when you do this sort of thing, you really don't want to
alert every X items, you really want to alert if you have X items in Y time (if
you get one a day, you don't want to get an alert e-mail after a month and a
half, and an e-mail to a manager every three months)
When you start alerting on messages, you really do end up wanting a lot more
smarts, and while it would be neat to do this inside rsyslog, that would be a
MAJOR set of enhancements, and I think it would be better to concentrate on
improving rsyslog for it's main job (delivering and filtering messages).
tracking state between messages will require a major set of changes to rsyslog
internals (think of of problems like having multiple threads processing messages
and the need for them to start sharing state information (potentially a LOT of
state information)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
