On Wed, 30 Sep 2009, RB wrote: > On Wed, Sep 30, 2009 at 11:54, Kenneth Marshall <[email protected]> wrote: >> I do not think that the goal of this feature in rsyslog is to >> re-implement resolver functionality but to provide a fast-path >> mechanism to map IP addresses to names for the purposes of logging >> error messages. > > Although I agree with your assessment of the goal, the only difference > I see between the two is wording semantics. An RFC-compliant DNS > cache will, for all intents and purposes, look an awful lot like any > other caching, recursive-only DNS resolver (like dnscache). The only > major difference would be that it would accept requests via an API as > opposed to through a socket interface. > > Regardless, I have to sit on the same side as David and Michael - in > very high-performance environments, I doubt the difference between an > internal cache and an external one is going to be significant.
actually, I am thinking that in a high-performance environment, the difference between an internal name cache and an external one _is_ significant I just don't think the internal one should be a DNS RFC complient one. if you put everything in /etc/hosts it is faster than doing a query against a local caching server, but it's still significantly slower than looking it up in memory. remember that when you make the gethostbyname() call it has to do a lot of checking to see which name resolver libraries you have configured (which includes checking for the existance of multiple files), then call them in order until it finds the name. if you do a strace of this sometime you will see how much stuff goes on under the covers. skipping all of this is significant at high log rates. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
