[rsyslog] Change to mark message algo
hks.private at gmail.com
Wed Sep 17 16:41:22 CEST 2008
No concerns here - that makes significantly more sense to an
On Wed, Sep 17, 2008 at 9:42 AM, Rainer Gerhards
<rgerhards at hq.adiscon.com> wrote:
> initially driven by a performance discussion, the question has come up
> when mark messages should be processed.
> The current implementation is (by design) close to what sysklogd does:
> marks are generated in intervals for all outputs (files and such) and
> are send to each of the outputs. The outputs process the mark message if
> the output was idle for at least half the past interval (otherwise, the
> mark is simply ignored).
> So, looking from an individual output's point of view, mark messages do
> not happen at precise intervals after the last message was processed by
> the output, but seem to be rather random from that POV.
> In rsyslog, I use the time the message was handed over to the output as
> the time of last processing. Some (namely David Lang in the link below)
> can argue that this is incorrect, or at least not the only way to handle
> it valid. The argument is that the time of message reception is the one
> to look at when processing marks. After some hesitation, I see some
> logic in this definition and I am very tempted to change rsyslog to use
> that definition. Obviously, this can result in different mark handling
> than to what we have today. Usually, though, things are not really
> different, but they may become quite different if a messages was stuck
> in a queue for some time.
> I invite you to have a look at the relevant forum discussion. This is a
> good entry point:
> Please let me know if you have any concerns. If I do not hear anything,
> I'll change rsyslog to use the reception timestamp. This also has
> performance benefit.
> rsyslog mailing list
More information about the rsyslog