On Wed, Jun 19, 2013 at 2:48 PM, Radu Gheorghe <[email protected]>wrote:
> Hi Risto, > > Yes, I've used omprog and it's a good temporary solution :) There are two > things I've bumped into: > - performance. If you can develop (or pay Adiscon to develop) a rsyslog > output plugin that can do what your external program does, it will probably > be way faster. Because it can make use of rsyslog's features, like having > multiple threads or processing logs in batches > I guess Risto will run some input to SEC - am I right here? > - reliability. omprog will restart your external program if it goes down > for any reason. But your external program needs to ingest messages quickly, > otherwise the pipe will get full (and it's 4-64K, it's not clear to me. > Tiny, anyway). At that point you will lose messages. > > I have just checked the code and that is not intentional. I may have overlooked something, as omprog was originally writen to a user request, but that users disappeared when it was done and nobody else reported much on it. I think this is the right solution for external programs, and so I would be very happy to look into problems that the module may have. Rainer > I'd say omprog is good if you don't care very much about those two. If you > do, I'd either look at a new plugin or at writing to a file and picking up > those logs from a file (or distributed file system?). Writing to a file > opens another can of worms (like, your app has to know where it left off > when it restarts), but at least you have a beefy buffer. > > > 2013/6/19 Risto Vaarandi <[email protected]> > > > hi all, > > I was wondering what would be the best way to run an external program > from > > rsyslogd, so that the program's stdin would be connected to rsyslogd > over a > > pipe. > > > > From the rsyslogd docs, I've found the omprog module as one possible > > solution. For example, the following statements > > > > $ModLoad omprog > > $ActionOMProgBinary /root/test.sh > > *.* :omprog: > > > > run /root/test.sh from rsyslogd and feed all log messages to the standard > > input of /root/test.sh. > > > > My question is -- are there any other (or better) ways for achieving the > > same setup? > > > > (Of course, one obvious way would be to use a named pipe for > > communication.) > > > > kind regards, > > risto > > ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
