Hi Rsyslog Users,
I am trying to understand how queues work in Rsyslog. In case of non-direct
queues, message is copied and placed in the queue and message modifications
done by queue workers won't have any impact on the original message. Makes
sense here.
However, I am a little confused when it comes to direct Queue. What
happens in Direct Queue ? Will the message be copied or is it the same
message ? I tested out two scenarios (wrt rulesets and actions) and both
of them gave different results.
When ruleset is backed by a direct Queue, message modifications done in
ruleset don't reflect back in original flow where as in case of actions
(such mmnormalize, mmkubernetes) which are by default backed by direct
Queue, message modifications done with action reflects in original flow
Scenario 1:
template(name="abc" type="string" string="%$!var1% %$.var2% %msg%")
ruleset(name="relay.htp1" queue.type="Direct") {
call rs1
* // $!var1, $.var2 aren't available here*
action(type="omfile" file="/tmp/output.log" template="abc")
call relay.htp
}
ruleset(name="rs1" queue.type="Direct"){
set $!var1 = "hello";
set $.var2 = "bye";
}
input(type="imfile"
File="/tmp/input.log"
Ruleset="relay.htp1"
Tag="tag")
Scenario 2:
module(load = "mmnormalize")
ruleset(name = "relay.htp1" queue.type="Direct") {
action(type = "mmnormalize" ruleBase="/etc/rsyslog.d/service.rulebase"
path="$!msg")
* // $!msg will be available here even though action is backed by a
default Queue. *
}
input(type="imfile"
File="/tmp/input.log"
Ruleset="relay.htp1"
Tag="tag")
How come $!var1, $.var2 aren't available in scenario1 whereas $!msg is
available when both are using Direct Queue. Am I missing something here ?
--
Regards,
Rajesh KSV
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I am trying to understand how queues work in Rsyslog. In case of non-direct
queues, message is copied and placed in the queue and message modifications
done by queue workers won't have any impact on the original message. Makes
sense here.
However, I am a little confused when it comes to direct Queue. What
happens in Direct Queue ? Will the message be copied or is it the same
message ? I tested out two scenarios (wrt rulesets and actions) and both
of them gave different results.
When ruleset is backed by a direct Queue, message modifications done in
ruleset don't reflect back in original flow where as in case of actions
(such mmnormalize, mmkubernetes) which are by default backed by direct
Queue, message modifications done with action reflects in original flow
Scenario 1:
template(name="abc" type="string" string="%$!var1% %$.var2% %msg%")
ruleset(name="relay.htp1" queue.type="Direct") {
call rs1
* // $!var1, $.var2 aren't available here*
action(type="omfile" file="/tmp/output.log" template="abc")
call relay.htp
}
ruleset(name="rs1" queue.type="Direct"){
set $!var1 = "hello";
set $.var2 = "bye";
}
input(type="imfile"
File="/tmp/input.log"
Ruleset="relay.htp1"
Tag="tag")
Scenario 2:
module(load = "mmnormalize")
ruleset(name = "relay.htp1" queue.type="Direct") {
action(type = "mmnormalize" ruleBase="/etc/rsyslog.d/service.rulebase"
path="$!msg")
* // $!msg will be available here even though action is backed by a
default Queue. *
}
input(type="imfile"
File="/tmp/input.log"
Ruleset="relay.htp1"
Tag="tag")
How come $!var1, $.var2 aren't available in scenario1 whereas $!msg is
available when both are using Direct Queue. Am I missing something here ?
--
Regards,
Rajesh KSV
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.