[syslog-ng] Reliability of Remote logging via TCP/Syslog-NG

[Carson Gaspar]

--On Thursday, June 16, 2005 11:25 AM +0200 Balazs Scheidler 
<bazsi at balabit.hu> wrote:

> The problem that the same thing happens when the remote side does send
> something that terminates the connection. But the kernel does not react
> to it, but I agree there might other information pending in the kernel
> socket buffer. The real solution is to have some kind of application
> layer ack, or as you say, retransmit the last couple of messages when
> the connection is broken. (but how much and what happens to duplicate
> packets?)

I suggest a config tunable number of messages to retransmit, with the 
default being zero. Folks have a choice of:

- losing messages (under some, if not all, disconnect circumstances)
- risking duplicate messages
- running code that implements syslog-reliable (or whatever we're calling 
it these days - my IETF syslog WG mailing list mailbox is woefully 
behind...)

-- 
Carson