On Wed, 30 Sep 2009, Kenneth Marshall wrote: >>> mechanism to map IP addresses to names for the purposes of logging >>> error messages. As such, pretty much the only piece that needs to >>> be tracked within rsyslog is the TTL for the entry and the ip -> >>> name mapping. A thread would be responsible for expiring entries >>> from the cache (or refreshing the timeout) after validating the >>> correctness of the mapping. I think the DNS lookups should be >>> handled by a good resolver like pdns-recursor, djbdns,... The >>> goal here is to allow names in the log entries and not just IP >>> addresses and in a very high performance logging environment. >> >> the trouble is that doing _proper_ TTL expiration isn't as simple as it >> sounds. >> >> and if you are willing to back away from 'proper' expiration to something >> that will work in practice, why not go much further (as I have detailed in >> the other messages) >> >> David Lang > > I agree. I only mention TTL values as a reasonable upperbound of the > refresh check. The advantage is to remove the large pause in logging > due to a DNS refresh after a HUP to rsyslog, if that were the only > method to flush/refresh. Like you mention, the IPs/names of systems > being logged change rarely so we should tune this for speed and > not worry about expiration correctness. I do not agree so other > statements that an external cache will perform as well as an internal > cache. Too many software products that I work with have needed exactly > that functionality to support very high levels of performance.
actually, you could have the cache be configurable in three modes 1. no caching 2. blank the cache on HUP 3. never blank the cache (i.e. require a full restart to clear it) David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
