[rsyslog] imfile module - input line transformation

[RB]

> The problem with this approach is twofold. First, we are experiencing
> performance issues under increased load (all Apache workers in status "L"
> on the Apache server status page when stress testing).

I am somewhat surprised neither of the responders did what seems
obvious to me and bypass the pipe/execution altogether.  Unless
someone else here has had a problem doing so, there's no reason you
couldn't just use a named pipe on both ends:

[shell]
mkfifo /var/run/htlog-1

[apache]
CustomLog "/var/run/htlog-1"

[rsyslog]
$ModLoad imfile
$InputFileName /var/run/htlog-1
$InputFileTag apache1
$InputFileRunMonitor

That puts the logs in rsyslog with no extra executions or running
processes; what you do after that for filtering is up to you.  The
nice thing about using a named pipe is that if the reading process
dies, the buffer doesn't go away and you have less chance of losing
messages.