Hi,
initially driven by a performance discussion, the question has come up
when mark messages should be processed.
The current implementation is (by design) close to what sysklogd does:
marks are generated in intervals for all outputs (files and such) and
are send to each of the outputs. The outputs process the mark message if
the output was idle for at least half the past interval (otherwise, the
mark is simply ignored).
So, looking from an individual output's point of view, mark messages do
not happen at precise intervals after the last message was processed by
the output, but seem to be rather random from that POV.
In rsyslog, I use the time the message was handed over to the output as
the time of last processing. Some (namely David Lang in the link below)
can argue that this is incorrect, or at least not the only way to handle
it valid. The argument is that the time of message reception is the one
to look at when processing marks. After some hesitation, I see some
logic in this definition and I am very tempted to change rsyslog to use
that definition. Obviously, this can result in different mark handling
than to what we have today. Usually, though, things are not really
different, but they may become quite different if a messages was stuck
in a queue for some time.
I invite you to have a look at the relevant forum discussion. This is a
good entry point:
http://kb.monitorware.com/rsyslog-performance-t8691-30.html#p13825
Please let me know if you have any concerns. If I do not hear anything,
I'll change rsyslog to use the reception timestamp. This also has
performance benefit.
Thanks,
Rainer
initially driven by a performance discussion, the question has come up
when mark messages should be processed.
The current implementation is (by design) close to what sysklogd does:
marks are generated in intervals for all outputs (files and such) and
are send to each of the outputs. The outputs process the mark message if
the output was idle for at least half the past interval (otherwise, the
mark is simply ignored).
So, looking from an individual output's point of view, mark messages do
not happen at precise intervals after the last message was processed by
the output, but seem to be rather random from that POV.
In rsyslog, I use the time the message was handed over to the output as
the time of last processing. Some (namely David Lang in the link below)
can argue that this is incorrect, or at least not the only way to handle
it valid. The argument is that the time of message reception is the one
to look at when processing marks. After some hesitation, I see some
logic in this definition and I am very tempted to change rsyslog to use
that definition. Obviously, this can result in different mark handling
than to what we have today. Usually, though, things are not really
different, but they may become quite different if a messages was stuck
in a queue for some time.
I invite you to have a look at the relevant forum discussion. This is a
good entry point:
http://kb.monitorware.com/rsyslog-performance-t8691-30.html#p13825
Please let me know if you have any concerns. If I do not hear anything,
I'll change rsyslog to use the reception timestamp. This also has
performance benefit.
Thanks,
Rainer