From f7f20c3f5e0be02585741f5f54d198689ccd7866 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Mon, 15 Apr 2024 18:27:18 +0200 Subject: Adding upstream version 8.2402.0+dfsg. Signed-off-by: Daniel Baumann --- source/faq/difference_queues.rst | 34 ++++++++++++++++++++++++++++++++++ source/faq/index.rst | 7 +++++++ 2 files changed, 41 insertions(+) create mode 100644 source/faq/difference_queues.rst create mode 100644 source/faq/index.rst (limited to 'source/faq') diff --git a/source/faq/difference_queues.rst b/source/faq/difference_queues.rst new file mode 100644 index 0000000..458dc59 --- /dev/null +++ b/source/faq/difference_queues.rst @@ -0,0 +1,34 @@ +What is the difference between the main_queue and a queue with a ruleset tied to an input? +========================================================================================== + +A queue on a ruleset tied to an input replaces the main queue for that input. +The only difference is the higher default size of the main queue. + +If an input bounded ruleset does not have a queue defined, what default does it have? +------------------------------------------------------------------------------------- + +Rulesets without a queue on them use the main queue as a default. + +What is the recommended way to use several inputs? Should there be a need to define a queue for the rulesets? +------------------------------------------------------------------------------------------------------------- + +If you are going to do the same thing with all logs, then they should share a ruleset. + +If you are doing different things with different logs, then they should have +different rulesets. + +For example take a system where the default ruleset processes things and sends +them over the network to the nearest relay system. All systems have this same +default ruleset. +Then in the relay systems there is a ruleset which is tied to both TCP and UDP +listeners, and it receives the messages from the network, cleans them up, +and sends them on. +There is no mixing of these two processing paths, so having them as completely +separate paths with rulesets tied to the inputs and queues on the rulesets +makes sense. + +A queue on a ruleset tied to one or more inputs can be thought of as a separate +instance of rsyslog, which processes those logs. + + +Credits: davidelang diff --git a/source/faq/index.rst b/source/faq/index.rst new file mode 100644 index 0000000..29e7627 --- /dev/null +++ b/source/faq/index.rst @@ -0,0 +1,7 @@ +FAQ +=== + +.. toctree:: + :maxdepth: 1 + + difference_queues -- cgit v1.2.3