Depends on what you want to do with the actions. Most important question: if one action blocks, shall all others block as well? If the answer is yes, then go for the queue at the ruleset level.
As you know for omfile it almost always makes no sense to define a queue. Some for rulesets that contain only omfile actions. HTH Rainer El mar., 26 may. 2020 a las 16:19, Naoum, A. (Alexandros) via rsyslog (<[email protected]>) escribió: > > > Hi, > > Not sure if was asked before but I would like to ask what is the most > efficient way to add queues. > Scenario: > > Couple of rulesets with one action each ruleset to write to a file. All of > these ruleset are bind to one bigger one via call statement. The input will > be TCP mostly > Excluding the actions which I read that it is better for "omfile" to have > Direct, where is better to add queues? > Main? Each ruleset? On the ruleset that have the call statement? All of them? > A combination? > > > Regards, > Alexandros > > This message (including any attachments) may contain confidential > information. It is intended for use by the recipient only. Any dissemination, > copying or distribution to third parties without the express consent of the > sender is strictly prohibited. If you have received this message in error, > please delete it immediately and notify the sender. Thank you for your > collaboration. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
