RE: [logs] RE: syslog/tcp (selp)

From: Frank O'Dwyer (fodat_private)
Date: Wed Jan 15 2003 - 10:07:22 PST

  • Next message: Tina Bird: "[logs] tbird travelling"

    Bennet Todd wrote:
    > > But SELP/SLP/RLP ;) is a simplex protocol, without any
    > > acknowledgment from the receiver (except for the TCP
    > > acknowledgment).
    >
    > That TCP ack seems to me to be all that's needed.
    
    Well the TCP ack doesn't mean the logging application ever saw the data or
    successfully committed it somewhere. It would only matter in some tail end
    case where the logging server crashed or got rebooted at just the wrong
    moment, or maybe if the logging server went into some infinite tailspin, or
    ran out of storage. Of course when it matters it might really matter.
    
    So, "mostly reliable" is about right. A pre-requisite for real reliability
    would be some kind of positive ack from the receiving application, at which
    point the sender would be able to assume the entry was committed and forget
    about it.
    
    I'm not suggesting that this be added, just that is what would be needed.
    Indeed I think it would be problematic to implement that level of
    reliability where a chain of relays was involved. Done badly it would be a
    lot of overhead. You'd need to allow some kind of window of un-acked entries
    to make it work at reasonable speed I believe. Even this would not be 100%
    reliable, you'd need some kind of distributed transaction for that...
    
    Cheers,
    Frank
    
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 10:47:50 PST