[syslog-ng] pulling in "sar" data

[Jim Hendrick]

Hi list,

  Has anyone added sar data to syslog-ng? I know of a couple "brute-force"
ways like running a cron to run the sar command and dump it to a file. But
before I do that I wanted to check and see if there was a more elegant
solution.

 The overall problem would be to run this across 10,000+ servers with
minimal need to change configurations. (for example - if there was a need
to change the parameters to sar, or change the frequency of the pull).

 I guess I was hoping for some add-on that either directly pulled the
performance data from the kernel or could include a config that would
specify what data elements would be included.

FYI - we do use syslog-ng PE but this seems fairly generic so I thought I'd
ask the list.

 Given the scale of the problem, pulling "all" data even relatively
frequently (say every 1-5 minutes) would result in a huge volume increase
in our logging solution (where we pay by the ingested GB...)

Thoughts? Advice?

Thanks in advance!
Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20171230/acf5f5a4/attachment.html>