[rsyslog] does rsyslog supports data analytic

[david at lang.hm]

On Fri, 11 Sep 2009, Josh Zhao wrote:

> You mean I have to rewrite the processing module in rainerscript.where can i
> find  the detailed documents related to the scripting engine?

right now rainerscript is as much an idea as an implementation. it can be 
used for a few things, but mostly just for filter 'does this log match X' 
type of things.

David Lang

> Thank you!
> 2009/9/10 Rainer Gerhards <rgerhards at hq.adiscon.com>
>
>>> -----Original Message-----
>>> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
>>> bounces at lists.adiscon.com] On Behalf Of Josh Zhao
>>> Sent: Thursday, September 10, 2009 3:25 PM
>>> To: rsyslog-users
>>> Subject: Re: [rsyslog] does rsyslog supports data analytic
>>>
>>> Thanks for David and Rainer's reply.I m sorry that I did not explain my
>>> question clearly.I m new to rsyslog and want to add a processing module
>>> in
>>> rsyslog.The rsyslog has input plugins(front-end) and output
>>> plugins(back-end).My processing module receives data from input plugins
>>> and
>>> output the processed data and raw data both into output plugins.So how
>>> I add
>>> it?
>>
>> What you are looking for is a library plugin. Unfortunaley, library plugins
>> will work together with the scripting engine. In other words: there
>> currently
>> is no in-proc method available.
>>
>> What you can do, however, is chain two rsyslog instances, pipe data to your
>> plugin and send that data to the other instance. Far from perfect and easy
>> to
>> do, but maybe a workable work-around...
>>
>> Rainer
>>
>>>
>>>
>>> 2009/9/10 Rainer Gerhards <rgerhards at hq.adiscon.com>
>>>
>>>>> -----Original Message-----
>>>>> From: rsyslog-bounces at lists.adiscon.com
>>>>> [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of
>>> david at lang.hm
>>>>> Sent: Thursday, September 10, 2009 8:26 AM
>>>>> To: rsyslog-users
>>>>> Subject: Re: [rsyslog] does rsyslog supports data analytic
>>>>
>>>>>>  PS: i browse the git source code, but i can't understand why the
>>>>>>
>>>>> Experimental-lockfree<http://git.adiscon.com/?p=rsyslog.git;a=
>>>> shortlog;h=refs/heads/Experimental-lockfree>
>>>>>> is
>>>>>> not adopted?
>>>>>
>>>>> I believe that it boils down to complications in being sure
>>>>> that there are
>>>>> no bugs, and the fact that even without that there has been a
>>>>> LOT of room
>>>>> for improvement from the early 3.x timeframe to the current
>>>>> 5.x version.
>>>>>
>>>>> I expect that after the current round of improvements are
>>>>> settled that
>>>>> aspect of things will get reexamined.
>>>>
>>>> That branch is mostly there for historical reasons. I keep that
>>> branch as a
>>>> think-tank, but it is is obsoleted. Also, in less polite words than
>>> David
>>>> used, it simply doesn't work. Getting this code with multiple
>>> producers and
>>>> consumers correct is far from being trivial and the literature I
>>> browsed
>>>> indicates that it is probably not possible given the other predicates
>>> the
>>>> code must obey to. Still, optimization is high up on the todo list.
>>>>
>>>> Rainer
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com
>>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>