Mailing List Archive: custom properties and arm performance

custom properties and arm performance

Mar 15, 2024, 9:53 AM

Post #1 of 4 (72 views)

Hi everyone

I have two questions irrelevant with each other. I thought to ask these in one mail instead of two.

1.
Is there a way to add custom/user properties?

I have a bunch of rsyslog servers forwarding logs to a central rsyslog server. I want to "tag" the message prior to forwarding, and then on the receiving central rsyslog server use this tag for filtering.

I dont want to use the "tag" property because it already contains information from application logs.

I can add a custom field in a custom template, but that would inject it in the message (msg) which is something I was hoping to avoid (filtering by parsing the msg).

Is there a way to add custom properties which both forwarding and receiving rsyslog system can parse without having to filter the msg content?

1.
ARM CPU perfomance with rsyslog.

I am thinking to switch rsyslog systems (oci instances) to ARM base CPUs. I performed a few stress-tests compared to AMD and I didn't see significant changes. What I did noticed tho was, arm cpu was achieving the same results with less cpu utilization.

Before I move to production, is anyone aware of any issues with rsyslog and arm based cpus?

Have a nice weekend,

D.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: custom properties and arm performance [ In reply to ]

rsyslog at lists

Mar 15, 2024, 9:58 AM

Post #2 of 4 (72 views)

Permalink

> Is there a way to add custom/user properties?

That’s what the STRUCTURED_DATA header element is for.

> On Mar 15, 2024, at 11:53, Dimi Onobodies via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> Hi everyone
>
> I have two questions irrelevant with each other. I thought to ask these in one mail instead of two.
>
>
> 1.
> Is there a way to add custom/user properties?
>
> I have a bunch of rsyslog servers forwarding logs to a central rsyslog server. I want to "tag" the message prior to forwarding, and then on the receiving central rsyslog server use this tag for filtering.
>
> I dont want to use the "tag" property because it already contains information from application logs.
>
> I can add a custom field in a custom template, but that would inject it in the message (msg) which is something I was hoping to avoid (filtering by parsing the msg).
>
> Is there a way to add custom properties which both forwarding and receiving rsyslog system can parse without having to filter the msg content?
>
>
>
> 1.
> ARM CPU perfomance with rsyslog.
>
> I am thinking to switch rsyslog systems (oci instances) to ARM base CPUs. I performed a few stress-tests compared to AMD and I didn't see significant changes. What I did noticed tho was, arm cpu was achieving the same results with less cpu utilization.
>
> Before I move to production, is anyone aware of any issues with rsyslog and arm based cpus?
>
> Have a nice weekend,
>
> D.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: custom properties and arm performance [ In reply to ]

rsyslog at lists

Mar 15, 2024, 10:32 AM

Post #3 of 4 (70 views)

Permalink

On Fri, 15 Mar 2024, John Chivian via rsyslog wrote:

>> Is there a way to add custom/user properties?
>
> That’s what the STRUCTURED_DATA header element is for.

in theory yes, in practice RFC5424 does not have broad support for things like
structured data.

What is becoming more common in practice is using json in the message body and
parsing that on the receiver.

There are no known problems on any processor (ARM or anything else)

David Lang

>
>
>
>> On Mar 15, 2024, at 11:53, Dimi Onobodies via rsyslog <rsyslog@lists.adiscon.com> wrote:
>>
>> Hi everyone
>>
>> I have two questions irrelevant with each other. I thought to ask these in one mail instead of two.
>>
>>
>> 1.
>> Is there a way to add custom/user properties?
>>
>> I have a bunch of rsyslog servers forwarding logs to a central rsyslog server. I want to "tag" the message prior to forwarding, and then on the receiving central rsyslog server use this tag for filtering.
>>
>> I dont want to use the "tag" property because it already contains information from application logs.
>>
>> I can add a custom field in a custom template, but that would inject it in the message (msg) which is something I was hoping to avoid (filtering by parsing the msg).
>>
>> Is there a way to add custom properties which both forwarding and receiving rsyslog system can parse without having to filter the msg content?
>>
>>
>>
>> 1.
>> ARM CPU perfomance with rsyslog.
>>
>> I am thinking to switch rsyslog systems (oci instances) to ARM base CPUs. I performed a few stress-tests compared to AMD and I didn't see significant changes. What I did noticed tho was, arm cpu was achieving the same results with less cpu utilization.
>>
>> Before I move to production, is anyone aware of any issues with rsyslog and arm based cpus?
>>
>> Have a nice weekend,
>>
>> D.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: custom properties and arm performance [ In reply to ]

rsyslog at lists

Mar 15, 2024, 1:01 PM

Post #4 of 4 (70 views)

Permalink

Noted. Thanks for the help

Mar 15, 2024 19:32:43 David Lang via rsyslog <rsyslog@lists.adiscon.com>:

> On Fri, 15 Mar 2024, John Chivian via rsyslog wrote:
>
>>> Is there a way to add custom/user properties?
>>
>> That’s what the STRUCTURED_DATA header element is for.
>
> in theory yes, in practice RFC5424 does not have broad support for things like structured data.
>
> What is becoming more common in practice is using json in the message body and parsing that on the receiver.
>
> There are no known problems on any processor (ARM or anything else)
>
> David Lang
>
>>
>>
>>
>>> On Mar 15, 2024, at 11:53, Dimi Onobodies via rsyslog <rsyslog@lists.adiscon.com> wrote:
>>> Hi everyone
>>> I have two questions irrelevant with each other. I thought to ask these in one mail instead of two.
>>>
>>> 1.
>>> Is there a way to add custom/user properties?
>>> I have a bunch of rsyslog servers forwarding logs to a central rsyslog server. I want to "tag" the message prior to forwarding, and then on the receiving central rsyslog server use this tag for filtering.
>>> I dont want to use the "tag" property because it already contains information from application logs.
>>> I can add a custom field in a custom template, but that would inject it in the message (msg) which is something I was hoping to avoid (filtering by parsing the msg).
>>> Is there a way to add custom properties which both forwarding and receiving rsyslog system can parse without having to filter the msg content?
>>>
>>>
>>> 1.
>>> ARM CPU perfomance with rsyslog.
>>> I am thinking to switch rsyslog systems (oci instances) to ARM base CPUs. I performed a few stress-tests compared to AMD and I didn't see significant changes. What I did noticed tho was, arm cpu was achieving the same results with less cpu utilization.
>>> Before I move to production, is anyone aware of any issues with rsyslog and arm based cpus?
>>> Have a nice weekend,
>>> D.
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.