# Dynamic Stats

Rsyslog produces runtime-stats to allow user to study service health, performance, bottlenecks etc. Runtime-stats counters that Rsyslog components publish are statically defined.

Dynamic Stats (called dyn-stats henceforth) component allows user to configure stats-namespaces (called stats-buckets) and increment counters within these buckets using Rainerscript function call.

The metric-name in this case can be a message-property or a sub-string extracted from message etc.

## Dyn-stats configuration

Dyn-stats configuration involves a two part setup.

### dyn_stats(name=”<bucket>”…) (object)

Defines the bucket(identified by the bucket-name) and allows user to set some properties that control behavior of the bucket.

    dyn_stats(name="msg_per_host")

Parameters:

  name <string litteral, mandatory> : Name of the bucket.

  resettable <on|off, default: on> : Whether or not counters should be reset every time they are reported. This works independent of `resetCounters` config parameter in impstats: Generate Periodic Statistics of Internal Counters.

  maxCardinality <number, default: 2000> : Maximum number of unique counter-names to track.

  unusedMetricLife <number, default: 3600> : Interval between full purges (in seconds). This prevents unused counters from occupying resources forever.

A definition setting all the parameters looks like:

    dyn_stats(name="msg_per_host" resettable="on" maxCardinality="3000" unusedMetricLife="600")

### dyn_inc(“<bucket>”, <expr>) (function)

Increments counter identified by value of variable in bucket identified by name.

Parameters:

  name <string litteral, mandatory> : Name of the bucket

  expr <expression resulting in a string> : Name of counter (this name will be reported by impstats to identify the counter)

A `dyn_inc` call looks like:

    set $.inc = dyn_inc("msg_per_host", $hostname);

    if ($.inc != 0) then {
        ....
    }

`$.inc` captures the error-code. It has value `0` when increment operation is successful and non-zero when it fails. It uses Rsyslog error-codes.

## Reporting

Legacy format:

    ...
    global: origin=dynstats msg_per_host.ops_overflow=1 msg_per_host.new_metric_add=3 msg_per_host.no_metric=0 msg_per_host.metrics_purged=0 msg_per_host.ops_ignored=0
    ...
    msg_per_host: origin=dynstats.bucket foo=2 bar=1 baz=1
    ...

Json(variants with the same structure are used in other Json based formats such as `cee` and `json-elasticsearch`) format:

    ...
    { "name": "global", "origin": "dynstats", "values": { "msg_per_host.ops_overflow": 1, "msg_per_host.new_metric_add": 3, "msg_per_host.no_metric": 0, "msg_per_host.metrics_purged": 0, "msg_per_host.ops_ignored": 0 } }
    ...
    { "name": "msg_per_host", "origin": "dynstats.bucket", "values": { "foo": 2, "bar": 1, "baz": 1 } }
    ...

In this case counters are encapsulated inside an object hanging off top-level-key `values`.

### Fields

global: origin=dynstats:

  ops_overflow: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality.

  new_metric_add: Number of “new” metrics added (new counters created).

  no_metric: Counter-name given was invalid (length = 0).

  metrics_purged: Number of counters discarded at discard-cycle (controlled by unusedMetricLife).

  ops_ignored: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can’t get access to counter without delay(lock acquiring latency).

  purge_triggered: Indicates that a discard was performed (1 implies a discard-cycle run).

msg_per_host: origin=dynstats.bucket:
  <metric_name>: Value of counter identified by <metric-name>.