RE: [logs] RE: syslog/tcp (selp)

From: Rainer Gerhards (rgerhardsat_private)
Date: Wed Jan 15 2003 - 07:02:59 PST

  • Next message: Mikael Olsson: "Re: [logs] RE: syslog/tcp (selp)"

    > Ahh, I see. Thanks to buffering, sliding windows, etc. an app 
    > doesn't know how much data actually made it to the server; 
    > while it does get an error indication back eventually if 
    > something went wrong, it can't know how much it needs to keep 
    > buffered to ensure no logs are ever lost, and it doesn't know 
    > how much to re-send in the event of error, so even if it 
    > keeps a nice deep buffer, you end up chosing between a risk 
    > of losing data and a risk of having log entries duplicated.
    Yes, that's the issue. And this is also why I posted a really bad idea
    (fortunately now abandoned) in an earlier post. For the same reason, the
    receiver MUST accept all packets sent to it (or silently ignore them). I
    once suggested a mode (extendend?) and said that the receiver might
    decide to not accept packages in this mode. However, in this case there
    would be no indication to the sender of whether the receiver opted to
    not accept it or there was just a network problem. As such, number one
    rule for simplex protocols is "the receiver must accept it all"...
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 07:13:11 PST