Random sampling

Rsyslog supports various sampling mechanisms. These can be used on client systems to save servers from getting overwhelmed. Here we introduce a new sampling mechanism “Random sampling”.

Let’s consider a system that is generating logs at rate of 100 logs/sec. If we want to get 20% of these logs uniformly sampled we use random sampling.

set $.rand = random(100);
if ($.rand <= 20) then {
  //send out
}

Above config will collect 20% of logs generated.

See also

Help with configuring/using Rsyslog:

  • Mailing list - best route for general questions
  • GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with Rsyslog
  • Stack Exchange (View, Ask) - experimental support from rsyslog community

See also

Contributing to Rsyslog: