On Wed, 30 Sep 2009, Michael Biebl wrote: > 2009/9/30 <[email protected]>: >> >> going back to basics here. >> >> Why is this feature desired? why not just use a caching nameserver >> listening on localhost? >> > > Was wondering about this myself. There are small caching nameservers > like dnsmasq which will do all the hard work for you. > Rainer, have you evaluated such an option?
by itself, this would not solve the problems 1. with the current situation where the lookups are done as the message is being received, the time taken to do the lookup (especially in the case where the lookup is not yet in the cache) can take long enough that log messages get lost 2. when you are talking message rates of 100K logs/sec and up the overhead of doing a DNS query, even to a server running on localhost that has the info cached in it, becomes a signficant amount of the total time you have to process that message before the next message arrives. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
