Hi Stefan, On Wed, Aug 18, 2010 at 04:57:21PM +0100, Stefan Cocora wrote: > I've finally got the syslog part to work. > I'm fully aware this change will increase the memory usage but I'm > compelled to make this change, management wants to log everything. :/
"everything" can mean anything. Haproxy itself does not log "everything". You can capture a certain amount of headers, for a certain size, but you're still limited. Network capture is a lot more efficient at logging "everything". And it's important to realize that by logging too much noise, you don't leave enough space or bandwidth for the important things. > I found that changing the log_msg_size in syslog-ng (this is the syslog > server that I'm using) allows me to log a big GET request. And your GET requests are more than 1kB large ? > I'm a bit puzzled about what you've said about MTU. From my knowledge if > the packet is too big it will be fragmented to the size of the MTU, yes > and > if a MTU frame is lost it will be retransmitted. and no :-) The only way to know it's been lost is to have an acknoledgement, which you don't have at the IP level. So when one fragment is lost, either you're on a reliable protocol (eg: TCP) and the whole segment gets retransmitted (all fragments), or you're on an unreliable protocol (eg: UDP) and the whole packet is definitely lost. One more reason to keep logs small, because the larger, the higher the risk of losing one fragment, hence the whole log! Regards, Willy
