Re: [rsyslog] imfile facility bug

2013-10-02 Thread David Lang
ahh, I forgot about that bug. no, the commit that fixes this is 98745101a103d1aef7a6c79cec8708729a2895fa and went into the tree Sep 18, and there hasn't been a release since then. the patch that went in is http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=98745101a103d1aef7a6c79cec8708729a

Re: [rsyslog] imfile facility bug

2013-10-02 Thread Matt Davis
Yup, that's correct. I am using version 7.4.3 right now, and didn't see this addressed in the changelog for 7.4.4, but maybe I missed it. Setting Facility to anything above local0 will not work: it defaults to local0 regardless. I saw a forum post about this (not on my laptop with the link atm),

Re: [rsyslog] imfile facility bug

2013-10-02 Thread David Lang
does it not work when you set the facility? what version are you using? David Lang On Wed, 2 Oct 2013, Matt Davis wrote: Hey all, I really want to use imfile and set the Facility to something other than local0, has the bug fix for this been added to any currently released beta version? If no

[rsyslog] imfile facility bug

2013-10-02 Thread Matt Davis
Hey all, I really want to use imfile and set the Facility to something other than local0, has the bug fix for this been added to any currently released beta version? If not, is there a patch available? Or, does anyone have suggestions on how to get around it? I'm using logstash as a central syslo

Re: [rsyslog] interested in rsyslog on AIX?

2013-10-02 Thread Rainer Gerhards
In short: no real response, no interest. It has become very low prio for me. Sent from phone, thus brief. Am 02.10.2013 23:15 schrieb "Dave Marquardt" : > Rainer Gerhards writes: > > > we are looking for folks who are interested in AIX and would like to help > > us port the current version of r

Re: [rsyslog] interested in rsyslog on AIX?

2013-10-02 Thread Dave Marquardt
Rainer Gerhards writes: > we are looking for folks who are interested in AIX and would like to help > us port the current version of rsyslog to it. > > Details in my blog posting: > > http://blog.gerhards.net/2013/06/rsyslog-on-aix-who-wants-to-help-porting.html Hi Rainer. Did you get any respo

[rsyslog] How can you set the syslogtag without using omfile?

2013-10-02 Thread Clif Smith
I'm wanting to direct logs coming from Elasticsearch to the appropriate destination, locally and on my central log server. Unfortunately, within Elasticsearch, I don't see a way to set anything other than the log facility. I'm running rsyslogd v5.8.6, the latest supported by Ubuntu 12.04. Not

Re: [rsyslog] Tr : Re: perfomance tweaking (fwd)

2013-10-02 Thread Robert
This is at 350k [rcortiz@simon ~]$ sudo nice -10 /usr/sbin/tcpdump -i eth2.10 -s 90 -nn port 514 -B 49152 -w /tmp/tcpdump | cut -c 1-8 | uniq -c tcpdump: listening on eth2.10, link-type EN10MB (Ethernet), capture size 90 bytes 2362650 packets captured 2366273 packets received by filter 0 packets

Re: [rsyslog] Tr : Re: perfomance tweaking (fwd)

2013-10-02 Thread David Lang
On Wed, 2 Oct 2013, Robert wrote: When I wrote to file it didnt drop anything at 300k good, go ahead and push it to 350k and 400k and let's see how far you can go. David Lang [rcortiz@simon ~]$ sudo nice -10 /usr/sbin/tcpdump -i eth2.10 -s 90 -nn port 514 -B 16384 -w /tmp/tcpdump | cut -c

Re: [rsyslog] Tr : Re: perfomance tweaking (fwd)

2013-10-02 Thread Robert
These are the current sysctl settings: # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 0 # Controls source route verification net.ip

Re: [rsyslog] Tr : Re: perfomance tweaking (fwd)

2013-10-02 Thread Robert
When I wrote to file it didnt drop anything at 300k [rcortiz@simon ~]$ sudo nice -10 /usr/sbin/tcpdump -i eth2.10 -s 90 -nn port 514 -B 16384 -w /tmp/tcpdump | cut -c 1-8 | uniq -c tcpdump: listening on eth2.10, link-type EN10MB (Ethernet), capture size 90 bytes 31107322 packets captured 3110743

Re: [rsyslog] rsyslog v7 stable on debian 7.1

2013-10-02 Thread Erik van Dam
Hi Andre, Yes that's def. an option. But if Michael is allready working on an backport that would be way better. Regards, Erik On Wed, 2 Oct 2013 10:57:22 +0200 Andre Lorbach wrote: > As Michael Biebl already said, there are properly to many differences in > Ubuntu. > Is compiling RSyslog on

Re: [rsyslog] rsyslog v7 stable on debian 7.1

2013-10-02 Thread Andre Lorbach
As Michael Biebl already said, there are properly to many differences in Ubuntu. Is compiling RSyslog on your machine an option? Best regards, Andre > -Original Message- > From: Erik van Dam [mailto:e...@fortytwo.nl] > Sent: Wednesday, October 02, 2013 10:20 AM > To: alorb...@adiscon.com;

Re: [rsyslog] rsyslog v7 stable on debian 7.1

2013-10-02 Thread Erik van Dam
Hi Andre, I'm trying to install it on debian 7.1 Regards, Erik On Tue, 1 Oct 2013 17:18:20 +0200 Andre Lorbach wrote: > I wouldn't put my hand into the fire for this. It might work, it might > not. > Which debian version are you using? > > Best regards, > Andre > > > -Original Message---

Re: [rsyslog] rsyslog v7 stable on debian 7.1

2013-10-02 Thread Erik van Dam
Hi Michael, Yes i read about you in some previous threads. Could you give some indication of when it will be available in backports? Thanks On Tue, 1 Oct 2013 22:19:06 +0200 Michael Biebl wrote: > 2013/10/1 Michael Biebl : > > 2013/10/1 Erik van Dam : > >> Hello all, > >> > >> Is it save to u