[logs] Re: Looking for toolkits and products that support RFC3195-- COOKED

From: Bennett Todd (bet@private)
Date: Thu Aug 04 2005 - 08:55:00 PDT

2005-08-04T14:53:58 Rainer Gerhards:
> > 2005-08-04T10:03:21 Rainer Gerhards:
> > > [...] What I currently do in rsyslog is to create tcp connections,
> > > but only send messages via them if that would not block.
> > 
> > Sweet! Wish I'd thought of that. Now we need to teach syslog(3)
> > about that trick.
> well... I guess that's a bit hard because it does not handle tcp at all
> ;) That was one reason for rsyslog to be created...

I should have explained myself more clearly.

I like what you're doing with rsyslog.

syslog(3) supports unix-stream and unix-dgram for /dev/log, at least
on Linux which is the only platform I care about these days. Given
that, you have a choice, you can go for reliable local logging
syslog(3) -> syslogd, using unix-stream, or you can go for
decoupled, unreliable logging using unix-dgram, and ensure that your
apps won't block on a hung or dead syslogd. If syslog(3) used the
same trick you're using for tcp, then you could enjoy the same
benefits, reliable message delivery when syslogd's there and keeping
up, without risking apps hanging.


LogAnalysis mailing list

This archive was generated by hypermail 2.1.3 : Thu Aug 04 2005 - 10:24:09 PDT