[syslog-ng] Architecture Question'

[Roberto Nibali]

Hello,

7000 other servers sound like quite a large amount of machines to be 
handled only in one collision domain.

> Yes, i know it is not specific enough ...

They try to be a little bit more specific.

> But nobody here can tell me exactly the frequency of the logs that will 
> be sent :-/

42.

See, it completely depends on what exactly you're logging. What are the 
servers running?

> One thing is sure : it wont be 1 message per server per day, but 
> something like 500 /server /days ...

That's 3500000 a day or ~40/s if they would be evenly distributed, which 
they are not of course. You should build a system that can at least 
handle 10 times the calculated average message to handle peak 
situations. So that's 400/s. If you take an average COTS Xeon 2-CPU box 
with roughly 3GHz CPUs, you will be able to reliably handle 10000 
messages/s when using TCP and about 5000 - 7000 messages/s when logging 
via UDP.

> Do you want to know something else ?

What is your task exactly? No one give someone a job to integrate and 
handle messages of 7000 boxes onto a syslog server without a clear 
specification.

Regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc