I have noticed that using the omudpspoof action with the omudpspoof module enabled results in very slow forwards. I suspect this is due to the action of creating new sockets for each message being spoofed.
I have noticed, that even if all the messages being forwarded via a omudpspoof action are from a single ip address, it creates new sockets for each message being forwarded. This results in very slow forwarding times. I believe it would be much quicker, if instead, a single socket is created for each unique source ip address, send all messages via the open socket, keep that session open for a given timeout (perhaps configurable), and if it remains idle for that timeframe, close it. I attempted to speed up the forwarding process by limiting the spoof port start and end configuration options to a single port, but there was no noticeable increase in speed. I am running version 5.8.6 on RHEL 5.6 Brandon Murphy | IT Network Security Assoc-Lead | Information Services - Information Security | The Principal Financial Group(r) | ph 515.247.5161 </pre><br>-----Message Disclaimer-----<br><br>This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to [email protected] and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation.<br><br> Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message.<br><br>While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.<br><pre> _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
