Re: [rsyslog] Capturing shutdown logs

2024-03-15 Thread Attila Lakatos via rsyslog
The solution is clean to me, however I think this could be a bottleneck for busy systems. Also, this would mean that I need to maintain a copy of journal logs in one or more files. On Wed, Mar 13, 2024 at 2:53 PM John Chivian wrote: > You could split rsyslog into two separate service instances.

Re: [rsyslog] Capturing shutdown logs

2024-03-15 Thread Attila Lakatos via rsyslog
Actually, I realized that dependency on the network.target is not the sole problem why shutdown logs are not persisted. Upon shutdown, there's a delay in rsyslog fetching new logs from the journal via the journal API. By the time it can access the journal, a SIGTERM signal has already been sent to

Re: [rsyslog] Capturing shutdown logs

2024-03-15 Thread David Lang via rsyslog
imjournal uses the journal api to fetch the logs (fetching them in near-real-time), journald keeps files internally to support it. David Lang On Fri, 15 Mar 2024, Attila Lakatos via rsyslog wrote: The solution is clean to me, however I think this could be a bottleneck for busy systems. Also,

[rsyslog] custom properties and arm performance

2024-03-15 Thread Dimi Onobodies via rsyslog
Hi everyone I have two questions irrelevant with each other. I thought to ask these in one mail instead of two. 1. Is there a way to add custom/user properties? I have a bunch of rsyslog servers forwarding logs to a central rsyslog server. I want to "tag" the message prior to forwarding, an

Re: [rsyslog] custom properties and arm performance

2024-03-15 Thread John Chivian via rsyslog
> Is there a way to add custom/user properties? That’s what the STRUCTURED_DATA header element is for. > On Mar 15, 2024, at 11:53, Dimi Onobodies via rsyslog > wrote: > > Hi everyone > > I have two questions irrelevant with each other. I thought to ask these in > one mail instead of two.

Re: [rsyslog] custom properties and arm performance

2024-03-15 Thread David Lang via rsyslog
On Fri, 15 Mar 2024, John Chivian via rsyslog wrote: Is there a way to add custom/user properties? That’s what the STRUCTURED_DATA header element is for. in theory yes, in practice RFC5424 does not have broad support for things like structured data. What is becoming more common in practic

Re: [rsyslog] custom properties and arm performance

2024-03-15 Thread Dimi via rsyslog
Noted. Thanks for the help Mar 15, 2024 19:32:43 David Lang via rsyslog : > On Fri, 15 Mar 2024, John Chivian via rsyslog wrote: > >>> Is there a way to add custom/user properties? >> >> That’s what the STRUCTURED_DATA header element is for. > > in theory yes, in practice RFC5424 does not have