Hi, I would have a question about the configuration parameter queue.discardseverity. According to the documentation:
“As soon as the threshold of the parameter queue.discardMark is reached incoming as well as queued messages with a priority equal or lower than specified will be erased. With the default no messages will be erased. You have to specify a numeric severity value for this parameter.” Also if I look the documentation of discardMark: “Specifies the threshold at which rsyslog begins to discard less important messages. To define which messages should be discarded use the queue.discardseverity parameter.” The first description is a bit vague, because it mentions priority equal or lower. RFC5424 does specify what priority means, but it should be calculated based on the facility and severity values, and it is a 1-3 digit long number. Does it mean this kind of priority, or rather the severity is called priority here? On the other hand I think saying “equal or lower” is also a bit strange. Do you really mean lower-equal, and not higher-equal? Thus specifying a value, for eg. 3 would mean that I drop ERR, CRIT, and so on messages, which are the most important, but have the lowest severity number assigned. I think it would rather work like higher-equal, and thus filtering the least important (debug/info/notice) messages, but keeping the most important ones. Does not it work like this? I think the documentation should be aligned with syslog RFC. On the other hand the doumentation talks about percents in case of discardMark. But should I put here the number of events, when discard will happen? Or is this really a percentage? Could somebody clarify my questions? Thanks, Gábor _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
