[syslog-ng] Using syslog-ng for NAS

[Naoto MATSUMOTO]

  Hi, all

  I have some question.

  The Balabit syslog-ng can be relaying UDP to TCP.

     source and destination syntax eg.)
       Syntax:        udp <ipaddr>,<port>;
       Sends messages to the given host & port using UDP datagrams.
       Example:        udp 193.6.40.37,514;

  Is it the best for this situation ?
 
 (1) old syslogd style
                  
    [NAS]........UDP.........................  
                                              .<Drop!>
    [NAS]........UDP.........................[Syslog]----IO->(Disk)
                                              .<Drop!>
    [NAS]........UDP.........................

    NAS: Network Access Server
 
 (2) using syslog-ng
 
                      <Buffered?+Relay!>                 
                       vvvvvvvvv
    [NAS]........UDP..[Syslog-ng]______TCP___
                      .                      \
    [NAS]........UDP.                        [Syslog-ng]--IO->(Disk)
                                 ______   ___/
    [NAS]........UDP..[Syslog-ng]      TCP
                       ^^^^^^^^^
                      <Buffered?+Relay!>

   It's correct?

   I want to understand that cause of dropping UDP on syslog.
   (the cause is the UDP stack on kernel(OS)?)

  Regards,

-----
 IRI [Internet Research Institute,Inc.] Naoto MATSUMOTO <not@iri.co.jp>