[rsyslog] does rsyslog supports data analytic

[Rainer Gerhards]

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Josh Zhao
> Sent: Thursday, September 10, 2009 3:25 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] does rsyslog supports data analytic
> 
> Thanks for David and Rainer's reply.I m sorry that I did not explain my
> question clearly.I m new to rsyslog and want to add a processing module
> in
> rsyslog.The rsyslog has input plugins(front-end) and output
> plugins(back-end).My processing module receives data from input plugins
> and
> output the processed data and raw data both into output plugins.So how
> I add
> it?

What you are looking for is a library plugin. Unfortunaley, library plugins
will work together with the scripting engine. In other words: there currently
is no in-proc method available.

What you can do, however, is chain two rsyslog instances, pipe data to your
plugin and send that data to the other instance. Far from perfect and easy to
do, but maybe a workable work-around...

Rainer

> 
> 
> 2009/9/10 Rainer Gerhards <rgerhards at hq.adiscon.com>
> 
> > > -----Original Message-----
> > > From: rsyslog-bounces at lists.adiscon.com
> > > [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of
> david at lang.hm
> > > Sent: Thursday, September 10, 2009 8:26 AM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] does rsyslog supports data analytic
> >
> > > >  PS: i browse the git source code, but i can't understand why the
> > > >
> > > Experimental-lockfree<http://git.adiscon.com/?p=rsyslog.git;a=
> > shortlog;h=refs/heads/Experimental-lockfree>
> > > > is
> > > > not adopted?
> > >
> > > I believe that it boils down to complications in being sure
> > > that there are
> > > no bugs, and the fact that even without that there has been a
> > > LOT of room
> > > for improvement from the early 3.x timeframe to the current
> > > 5.x version.
> > >
> > > I expect that after the current round of improvements are
> > > settled that
> > > aspect of things will get reexamined.
> >
> > That branch is mostly there for historical reasons. I keep that
> branch as a
> > think-tank, but it is is obsoleted. Also, in less polite words than
> David
> > used, it simply doesn't work. Getting this code with multiple
> producers and
> > consumers correct is far from being trivial and the literature I
> browsed
> > indicates that it is probably not possible given the other predicates
> the
> > code must obey to. Still, optimization is high up on the todo list.
> >
> > Rainer
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com