Hello *, Question: does syslog-ng scale well on a central syslog_Server collecting messages from about 200 unix hosts ? I have read old threads about this issue and found infos about a fixed bug and mention about one list member planning measurements with respect to scaling / message dropping. I am still a bit insecure: Can the receive buffer in syslog-ng made large enough to handle incomming syslog messages from about 200 hosts without dropping messages ? Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side) TIA Micha
On Tue, 13 Apr 2004, Michael Arndt wrote:
Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side)
You might be able to use the TCP transport, which could give you better reliability; but the best alternative is to duplicate all syslog messages to a single local file. That way you know they won't be lost. -------------------- Christopher Josephes cpj1@visi.com
On Tue, Apr 13, 2004 at 11:33:37AM -0500, Chris Josephes wrote:
On Tue, 13 Apr 2004, Michael Arndt wrote:
Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side)
You might be able to use the TCP transport, which could give you better reliability; but the best alternative is to duplicate all syslog messages to a single local file. That way you know they won't be lost.
One of these days soon I'm going to cobble something together like socklog's tryto, but for syslog-ng. http://smarden.org/socklog/network.html Basically everything is logged locally, then when the log hits a certain size an attempt is made to transfer it to a central location. I don't like the delay in transmission though, since it gives the possibility to remove the logs before transmission. I might must move the network transmission into a simple perl script that falls back to local logging when a TCP connection is broken, then tries to retransmit when the connection is re-established. If the concept works out well, maybe a real programmer could write it into syslog-ng so that it's behavior could be controlled via syslog-ng.conf. This feature seems like a natural direction for syslog-ng to go in, IMO anyways. -- Nate "The percentage of users running Windows NT Workstation 4.0 whose PCs stopped working more than once a month was less than half that of Windows 95 users."-- microsoft.com/ntworkstation/overview/Reliability/Highest.asp
participants (3)
-
Chris Josephes
-
Michael Arndt
-
Nate Campi