[syslog-ng]Performance Tests

[Dan Edwards]

You can use TCP with syslog-ng also.  UDP will obviously always not have
100% of all message traffic on any platform because if there is any
errors in transmit there is no checking to resend it since it is a
socket less connection.

I ran tests on syslog-ng tcp and it got every single message that a kiwi
syslog daemon using tcp got.  The bottom line, if you use UDP no matter
what platform you use it will loose some messages.  I have run Syslog-ng
UDP against syslogd and kiwi and they all got around the same amounts
(Within 5 lines in a log of over 10000 lines).

A small caution about using TCP with Syslogs.  One must remember that
TCP has acknowledgement of receipt.  If for some reason your Syslog
server is not running (IE: Rebooting).  A properly design device will
stop functioning until it has return to prevent unlogged activity.  In
their mind it could be someone hacking into your network and knocking
your Syslog server to cover themselves.  Great concept however heavy
network traffic can also cause delays which fill up the devices syslog
queue which causes it to think it can not talk and boom down goes the
network.  A great example of this is a Cisco PIX firewall.  Everything
can be working 100% great and all the sudden poof the internet is down.

Dan Edwards
Network Specialist
A. Duda & Sons, Inc.


-----Original Message-----
From: syslog-ng-admin@lists.balabit.hu
[mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Jack Krolen
Sent: Wednesday, April 23, 2003 12:39 PM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng]Performance Tests


I downloaded and installed syslog-ng.1.5.26 and then I read some
problems 
with performance.  Now say I use syslog-ng on my logging server.  And
all my 
production servers use syslogd.  Now am I to understand that since
syslogd 
uses UDP that there is going to be a considerable loss in message
transfer ?

Second of all since syslog-ng seems to have some problems is syslogd
more 
reliable for this ?




_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail

_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html