Re: [logs] Syslog over TCP (Was: Re: Syslog payload format)

Previous message: Richard Welty: "Re[2]: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

betat_private

2003-01-03T12:52:36 Gibson, Jerry,, DMDCWEST:
> Some devices require logging to function.  When using tcp and a
> problem develops on the syslog server the device sending syslogs
> will stop functioning, Cisco PIX firewall is one such device.

That this isn't a configurable option (if it can't log, should it
keep working or not) is arguably a defect in that device.

But I don't think this is an issue we have to address, with one
exception: if we're going to go ahead and provide an implementation
of syslog-over-tcp, we should remember that the sender should be
able to cope with an unreachable server; it'll have to have some way
to save messages until they can be sent.

Another place I've seen analogous behavior (log jams up, process
freezes) is in djbdns. There my fix is to gleefully /dev/null the
log data directly, so far I've not filled up my bit bucket.

-Bennett