Jason Royes wrote: > > [regarding the (smallish) chance of loss with syslog over TCP > in relation to lost connections and reconnects] > > Will the cost of implement reliability measures be worth it? "Reliable" reliability measures? No way. You'd need to know the exact send window size, AND assurance that there are no plug-gws between the log sender and receiver. (Good luck.) Semi-reliable, i.e. usually not lossy, but may generate duplicates? Perhaps. Keeping a ~64KB rotating window of output data that you always re-send on reconnect should do the trick in most cases. But reliably detecting duplicates at the analyzer end most likely requires some sort of sequential event ID in the payload, or at least high-precision timestamps. This is IMHO outside the scope of SELP, but it is an an interesting question that I don't mind discussing, as long as we do keep in mind that it's a separate problem. -- Mikael Olsson, Clavister AB Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden Phone: +46 (0)660 29 92 00 Mobile: +46 (0)70 26 222 05 Fax: +46 (0)660 122 50 WWW: http://www.clavister.com _______________________________________________ LogAnalysis mailing list LogAnalysisat_private http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 11:08:52 PST