The ideal solution would be one that identifies host, log-source and time of loss along with accurate number of messages lost.
pstats makes sense, but correlating data from stats across large number of machines will be difficult (some machines may send stats slightly delayed which may skew aggregation etc). One approach I can think of: slap a stream-identifier and sequence-number on each received message, then find gaps in sequence number for a session-id on the other side (as a query over log-store etc). Large issues such as producer suddenly going silent can be detected using macro mechanisms (like pstats). On Sat, Feb 13, 2016 at 2:56 AM, David Lang <da...@lang.hm> wrote: > On Sat, 13 Feb 2016, Andre wrote: > >> >> The easiest way I found to do that is to have a control system and send >> two >> streams of data to two or more different destinations. >> >> In case of rsyslog processing a large message volume UDP the loss has >> always been noticeable. > > > this depends on your setup. I was able to send UDP logs at gig-E wire speed > with no losses, but it required tuning the receiving sytem to not do DNS > lookups, have sufficient RAM for buffering, etc > > > I never was able to get my hands on 10G equiepment to push up from there. > > David Lang > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. -- Regards, Janmejay http://codehunk.wordpress.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
