Random sampling — rsyslog 8.1911.0 documentation

# Random sampling

Rsyslog supports various sampling mechanisms. These can be used on client systems to save servers from getting overwhelmed. Here we introduce a new sampling mechanism “Random sampling”.

Let’s consider a system that is generating logs at rate of 100 logs/sec. If we want to get 20% of these logs uniformly sampled we use random sampling.

    set $.rand = random(100);
    if ($.rand <= 20) then {
      //send out
    }

Above config will collect 20% of logs generated.

See also

Help with configuring/using `Rsyslog`:

- Mailing list - best route for general questions
- GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with `Rsyslog`
- Stack Exchange (View, Ask) - experimental support from rsyslog community

See also

Contributing to `Rsyslog`:

- Source project: rsyslog project README.
- Documentation: rsyslog-doc project README