[logs] Reliability of SELP (was syslog/tcp ...)

From: Bennett Todd (betat_private)
Date: Wed Jan 15 2003 - 11:05:20 PST

  • Next message: Russell Fulton: "Re: FW: [logs] Logging in the real world"

    I think the picture we've got is getting quite clear.
    Neither Syslog Classic (RFC 3164) nor SELP is syslog-reliable (RFC
    3195). RFC 3194, via UDP, is utterly unreliable, gracefully handling
    overloads by losing as much as needed to avoid getting overloaded.
    SELP doesn't guarantee perfectly reliable delivery in the case of
    errors in transit or on the server (due to TCP buffering and lack of
    precise reporting of successful/failed delivery of each bit of data
    back up to the app), but in normal operation it's substantially
    reliable, slowing down senders to the rate that the receiver can
    cope with rather than losing traffic.
    Reliable delivery requires a handshake at the application layer,
    where the receiver officially notifies the sender that it has
    accepted delivery for each message, allowing the sender to forget
    about it. That's where we turn to RFC 3195.

    _______________________________________________ LogAnalysis mailing list LogAnalysisat_private http://lists.shmoo.com/mailman/listinfo/loganalysis

    This archive was generated by hypermail 2b30 : Thu Jan 16 2003 - 10:09:34 PST