Configuring the event pool

Edit online

Events are passed to subscribed log agents asynchronously from the application-level requests that construct the events. All events enter the common propagation queue before they are forwarded to the subscribed log agents.

The propagation queue is configurable. To configure the propagation queue, define the logcfg stanza entry with EventPool as the category name and specifies the configuration parameters without specifying a log agent.

Manage the propagation queue to support the configuration of log agents. For example, limit the amount of memory that is used to queue events for a remote log agent. To limit the amount of memory that is used, constrain the propagation queue with the queue_size parameter:

[aznapi-configuration]
logcfg = EventPool queue_size=number,hi_water=number,
     flush_interval=number_seconds
logcfg = category:remote buffer_size=number,path=pathname,
     server=hostname,queue_size=number

You can define the following parameters for pipe log agents:

filter

The filter parameter is used to define which auditing events, for the audit.authn and audit.azn components, are included in the auditing log. The parameter contains a list of rules, which are separated by the pipe (|) character. Each rule starts with a + or - character to define whether the specified event is included or excluded from the auditing log. The *? pattern matching characters can also be used to identify the event. If no rules match the auditing event, the event is included in the auditing log. For example, to exclude all auditing events except for the event with an identifier of 114:

logcfg = audit.azn:file path=azn.log,filter=+114|-*

flush_interval

Configure the flush_interval parameter to limit the amount of time that events can remain in the propagation queue. Specify the time in seconds. Assume that the size of the queue does not reach the high water mark within the specified interval. In this case, events in the queue are forwarded to the log agents.

The default value is 10 seconds. Specifying a value of 0 is equivalent to setting the value to 600 seconds.

hi_water

Configure the hi_water parameter to indicate the threshold where events in the propagation queue are forwarded to the log agents. Assume that the size of the queue does not reach this high water mark within the defined flush interval. In this case, events in the queue are forwarded to the log agents.

The default value is calculated as two-thirds of the configured queue size. If the queue size is 0 (unlimited), the high water mark is set to 100 events. If the high water mark is 1 event, each event in the queue is forwarded immediately to the log agents.

Setting a low value for the high water mark can have an adverse effect on performance.

queue_size

Because each event in the propagation queue consumes memory, configure the queue_size parameter to define the maximum number of events that the propagation queue can hold. If the maximum size is reached, the event-producing thread is blocked until space is available in the queue. Blocking corresponds to throttling back the performance of the event-producing thread to a rate that can be consumed by the logging threads.

The default value is 0. Specifying a value of 0 indicates that no size limit is enforced on the propagation queue. The propagation queue can grow to an unmanageable size when:

You use the default value, and
The logging threads cannot process events as they enter the propagation queue.