[syslog-ng] Re: Reliable tcp logging

[Roberto Nibali]

> Well, yes, it is exactly the same issue and it is indeed only one line
> that gets lost (which in my case, where typically every host sends about
> 1 line/hour does not really make a difference).

You mean 1 line/hour that is lost, right?

> Unfortunately, the previous discussion does not sound very promising.
> Obviously there is no hope to get this fixed in 1.6.x...

There's always hope :). But someone knowledgable with how sockets work 
in various Unices and a lot of time needs to address this.

> How far from being ready for production use is 1.9.x?

I couldn't tell, the broad tester base is found to be wanting.

> Maybe I should go back to using udp instead, which is by definition
> unrealiable, but in this case probably would still yield a higher
> success rate?

What is your failure rate exactly? What is your rate of log messages per 
second? What's the average message size per log packet? Do you have 
macro expansion configured? How many regexp's are in your config? ...

With TCP based syslog'ing you can reliably (at least in my test 
conducts) send and receive about 15'000 messages per second with an 
average size of 128 bytes. This is already quite a lot for a production 
environment. I don't recall the number for UDP but if memory serves me 
well, it was something around 3000 messages per second.

HTH and best regards,
Roberto Nibali, ratz
-- 
echo 
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc