-----BEGIN PGP SIGNED MESSAGE----- And we've found that not only syslogd is the problem, kernel message queue may drop messages or even parts of them on certain conditions on heavy loaded BSD system :( and there seems to be no workaround yet. "Marcus J. Ranum" <mjrat_private> said : > Marcus J. Ranum wrote: > >Conclusions: > >syslogd is decidedly not OK for loads in the 10,000 messages/second range on > > my machine > > I didn't add the obvious: "which is ridiculous" > > A machine capable of servicing thousands of web hits/second should be > capable of logging them without dropping them on the floor. :) To aggregate > large amounts of logs, 10,000 messages/second might not be an extraordinary > number, assuming some buffering and sane handling of I/O on the host and > the network. I don't think I'd want to try to insert 10,000 records/second into > a SQL database, even using bulk inserts. ;) So one implication is that for > really big-ass (yes, that's the technical term...) logging servers prefiltering > and coalescing will be a requirement. Of course coalescing _fast_ is a real > challenge... ;) _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBPFf/UKH/mIJW9LeBAQFB3AQAqMvI0yB4ykXjS4T3zITfHSaCqWKNgQUr jVjbB24C13FGMRpVWAfh//aXQ3K7DWpmTSTvegfrVEMJ71hLRw9I0IngBYzHP6kL bVK5jJ3y7r4pMFR3/PgJ4y+GRYPN4xzquA2EirmvzCw2MkWF0Nx+VdCD6lOEuUnc G4fcTaCE2to= =0xvQ -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Wed Jan 30 2002 - 07:05:59 PST