[prev in list] [next in list] [prev in thread] [next in thread] 

List:       syslog-ng
Subject:    [syslog-ng] pulling in "sar" data
From:       Jim Hendrick <james.r.hendrick () gmail ! com>
Date:       2017-12-30 16:27:49
Message-ID: CANEn2ifCTv_mFxJ1ng43dg3B9MF4UzngJ+PG19NFF=HR=JcOxg () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


Hi list,

  Has anyone added sar data to syslog-ng? I know of a couple "brute-force"
ways like running a cron to run the sar command and dump it to a file. But
before I do that I wanted to check and see if there was a more elegant
solution.

 The overall problem would be to run this across 10,000+ servers with
minimal need to change configurations. (for example - if there was a need
to change the parameters to sar, or change the frequency of the pull).

 I guess I was hoping for some add-on that either directly pulled the
performance data from the kernel or could include a config that would
specify what data elements would be included.

FYI - we do use syslog-ng PE but this seems fairly generic so I thought I'd
ask the list.

 Given the scale of the problem, pulling "all" data even relatively
frequently (say every 1-5 minutes) would result in a huge volume increase
in our logging solution (where we pay by the ingested GB...)

Thoughts? Advice?

Thanks in advance!
Jim

[Attachment #5 (text/html)]

<div dir="ltr">Hi list,<div><br></div><div>   Has anyone added sar data to syslog-ng? \
I know of a couple &quot;brute-force&quot; ways like running a cron to run the sar \
command and dump it to a file. But before I do that I wanted to check and see if \
there was a more elegant solution.</div><div><br></div><div>  The overall problem \
would be to run this across 10,000+ servers with minimal need to change \
configurations. (for example - if there was a need to change the parameters to sar, \
or change the frequency of the pull).</div><div><br></div><div>  I guess I was hoping \
for some add-on that either directly pulled the performance data from the kernel or \
could include a config that would specify what data elements would be \
included.</div><div><br></div><div>FYI - we do use syslog-ng PE but this seems fairly \
generic so I thought I&#39;d ask the list.</div><div><br></div><div>  Given the scale \
of the problem, pulling &quot;all&quot; data even relatively frequently (say every \
1-5 minutes) would result in a huge volume increase in our logging solution (where we \
pay by the ingested GB...)</div><div><br></div><div>Thoughts? \
Advice?</div><div><br></div><div>Thanks in \
advance!</div><div>Jim</div><div><br></div></div>


[Attachment #6 (text/plain)]

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq



[prev in list] [next in list] [prev in thread] [next in thread]