[logs] TCP delivery reliability (was: re: syslog/tcp (selp))

From: Mikael Olsson (mikael.olssonat_private)
Date: Wed Jan 15 2003 - 10:59:32 PST

  • Next message: Bennett Todd: "[logs] Reliability of SELP (was syslog/tcp ...)"

    Jason Royes wrote:
    > [regarding the (smallish) chance of loss with syslog over TCP
    >  in relation to lost connections and reconnects]
    > Will the cost of implement reliability measures be worth it?
    "Reliable" reliability measures? No way. You'd need to know the
    exact send window size, AND assurance that there are no plug-gws
    between the log sender and receiver. (Good luck.)
    Semi-reliable, i.e. usually not lossy, but may generate duplicates?
    Perhaps. Keeping a ~64KB rotating window of output data that you always
    re-send on reconnect should do the trick in most cases.  But reliably
    detecting duplicates at the analyzer end most likely requires some sort 
    of sequential event ID in the payload, or at least high-precision 
    This is IMHO outside the scope of SELP, but it is an an interesting 
    question that I don't mind discussing, as long as we do keep in mind 
    that it's a separate problem.
    Mikael Olsson, Clavister AB
    Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
    Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
    Fax: +46 (0)660 122 50       WWW: http://www.clavister.com
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 11:08:52 PST