Hello, 7000 other servers sound like quite a large amount of machines to be handled only in one collision domain.
Yes, i know it is not specific enough ...
They try to be a little bit more specific.
But nobody here can tell me exactly the frequency of the logs that will be sent :-/
42. See, it completely depends on what exactly you're logging. What are the servers running?
One thing is sure : it wont be 1 message per server per day, but something like 500 /server /days ...
That's 3500000 a day or ~40/s if they would be evenly distributed, which they are not of course. You should build a system that can at least handle 10 times the calculated average message to handle peak situations. So that's 400/s. If you take an average COTS Xeon 2-CPU box with roughly 3GHz CPUs, you will be able to reliably handle 10000 messages/s when using TCP and about 5000 - 7000 messages/s when logging via UDP.
Do you want to know something else ?
What is your task exactly? No one give someone a job to integrate and handle messages of 7000 boxes onto a syslog server without a clear specification. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc