[rsyslog] Change to mark message algo

[(private) HKS]

No concerns here - that makes significantly more sense to an
undereducated sysadmin.

-HKS

On Wed, Sep 17, 2008 at 9:42 AM, Rainer Gerhards
<rgerhards at hq.adiscon.com> wrote:
> Hi,
>
> initially driven by a performance discussion, the question has come up
> when mark messages should be processed.
>
> The current implementation is (by design) close to what sysklogd does:
> marks are generated in intervals for all outputs (files and such) and
> are send to each of the outputs. The outputs process the mark message if
> the output was idle for at least half the past interval (otherwise, the
> mark is simply ignored).
>
> So, looking from an individual output's point of view, mark messages do
> not happen at precise intervals after the last message was processed by
> the output, but seem to be rather random from that POV.
>
> In rsyslog, I use the time the message was handed over to the output as
> the time of last processing. Some (namely David Lang in the link below)
> can argue that this is incorrect, or at least not the only way to handle
> it valid. The argument is that the time of message reception is the one
> to look at when processing marks. After some hesitation, I see some
> logic in this definition and I am very tempted to change rsyslog to use
> that definition. Obviously, this can result in different mark handling
> than to what we have today. Usually, though, things are not really
> different, but they may become quite different if a messages was stuck
> in a queue for some time.
>
> I invite you to have a look at the relevant forum discussion. This is a
> good entry point:
>
> http://kb.monitorware.com/rsyslog-performance-t8691-30.html#p13825
>
> Please let me know if you have any concerns. If I do not hear anything,
> I'll change rsyslog to use the reception timestamp. This also has
> performance benefit.
>
> Thanks,
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
>