Re: [logs] RE: syslog/tcp (selp)

From: Bennett Todd (betat_private)
Date: Wed Jan 15 2003 - 06:53:54 PST

  • Next message: Rainer Gerhards: "RE: [logs] RE: syslog/tcp (selp)"

    2003-01-15T09:43:22 Rainer Gerhards:
    > > Could you describe the scenario in which the current selp.txt 
    > > proposal is unreliable?
    > 
    > In essence, it is realiable as long as the TCP stream works. When
    > the stream is broken, we do not know exactly why that happened and
    > if (and when) the sender should re-try. You also don't know for
    > sure if the receiver really received the last message or so.
    
    Ahh, I see. Thanks to buffering, sliding windows, etc. an app
    doesn't know how much data actually made it to the server; while it
    does get an error indication back eventually if something went
    wrong, it can't know how much it needs to keep buffered to ensure no
    logs are ever lost, and it doesn't know how much to re-send in the
    event of error, so even if it keeps a nice deep buffer, you end up
    chosing between a risk of losing data and a risk of having log
    entries duplicated.
    
    A little grovelling around man pages doesn't find me any more
    details. Wish my Stevens was convenient to hand.
    
    -Bennett
    
    
    

    _______________________________________________ LogAnalysis mailing list LogAnalysisat_private http://lists.shmoo.com/mailman/listinfo/loganalysis



    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 07:08:49 PST