# Filebeat vs. rsyslog imfile module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 28, 2016, 8:05am UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257 "2016-10-28T08:05:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [October 28, 2016, 8:05am UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/1 "2016-10-28T08:05:38Z")
Hi there, In the context of a modern enterprise Linux environment, where rsyslog is pretty much omnipresent, I was wondering if there is any reason to prefer Filebeat vs. just using the [imfile module](http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html) of rsyslog. Has anybody tested both alternatives in production? Any thoughts? Thanks, Dan ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 28, 2016, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/2 "2016-10-28T13:14:53Z")
Rsyslog can and does send lines from files, but if I recall correctly, they end up wrapped in syslog format. You wind up having to parse or extract it back out to save space. ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [October 28, 2016, 1:32pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/3 "2016-10-28T13:32:40Z")
I would say it really is how you want to see it done, If your really pushed for resources, having one agent (Filebeat or rsyslog) would save you megs and CPU cycles If you crash rsyslog you put the risk of your system freezing. Once enough Kernel level logs queue up, your system will freeze till you recycle rsyslog Honestly, I know that filebeat is what everyone is using but I personally install the full version of logstash and do all my parsing on the system with the log files. Sort of a distributed processing, rather then a central server. But I am processing a lot of data. Other then that I could not think of any reason to use one over the other. ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [October 28, 2016, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/4 "2016-10-28T16:49:24Z")
Rsyslogd crashing and the system freezing would certainly be a strong argument in favour of using filebeat (or logstash). Does that happen a lot, in your experience? You mentioned you process a lot of data. Would you say that rsyslogd crashing is something that you've seen only with higher loads? ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [October 28, 2016, 4:54pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/5 "2016-10-28T16:54:13Z")
never did the imfile configurations, rsyslog is very stable though it does get frozen when file systems errors occur. Likee a disk going bad and becomes read only. Or something is wrong when the system comes up In general, default settings on rsyslog is very stable. as you add more complexity so does the chance of "unavailability" My gut feeling is that if you had an issue it probably the result of something else going wrong. Like Hardware failure or the application writing the logs run's away. ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [October 28, 2016, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/6 "2016-10-28T16:57:55Z")
Well I could definitely live with the occasional system freeze caused by hardware failure and the like. I'm thinking preferring rsyslog to the other solution for ease of deployment and configuration (it's already installed on all our servers). I think it offsets quite nicely the inconvenience of unpacking the data from the syslog format it gets sent in. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 18, 2016, 8:05am UTC](https://discuss.elastic.co/t/filebeat-vs-rsyslog-imfile-module/64257/7 "2016-11-18T08:05:40Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.