关于rsyslog的学习

从配置文件学起：

关于配置文件

1. 配置文件的解析参看文件 runtime/rsconf.c
2. $ActionExecOnlyWhenPreviousIsSuspended
   
   Sample: *.* @@primary-syslog.example.com $ActionExecOnlyWhenPreviousIsSuspended on & @@secondary-1-syslog.example.com # & is used to have more than one action for & @@secondary-2-syslog.example.com # the same selector - the mult-action feature & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off # to re-set it for the next selector

   1 2 3 4 5 6 7 8

   Sample:   *.* @@primary-syslog.example.com $ActionExecOnlyWhenPreviousIsSuspended on & @@secondary-1-syslog.example.com # & is used to have more than one action for & @@secondary-2-syslog.example.com # the same selector - the mult-action feature & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off # to re-set it for the next selector

3. …

关于模块

http://www.rsyslog.com/doc/rsyslog_conf_modules.html

 

问题

1. 关于 QueueTimeoutActionCompletion 的理解

摘自官方文档

Discarding Messages

An interesting application is with disk-assisted queues: if the discard watermark is set lower than the high watermark, message discarding will start before the queue becomes disk-assisted. This may be a good thing if you would like to switch to disk-assisted mode only in cases where it is absolutely unavoidable and you prefer to discard less important messages first.

翻译：

关于使用磁盘辅助队列的一个有意思的应用方式是： 如果“丢弃水位”被设置的低于“高水位”，将在启用磁盘之前开始丢弃消息。如果你情愿丢弃一些不重要的消息，也不愿意使用磁盘的话，这是一个不错的选择。

摘自： http://www.rsyslog.com/doc/queues.html

命名惯例

Output modules, and only output modules, should start with a file name of “om” (e.g. “omfile.c”, “omshell.c”). Similarly, input modules will use “im” and filter modules “fm”. The third character shall not be a hyphen.

摘自： http://www.rsyslog.com/doc/modules.html