1999-10-20-15:33:46 Roger Marquis:
> The choice of protocol should be based on the traffic it's carrying. For
> syslog that's fundamentally connectionless, stateless and by extension UDP.
I think I now see where our disagreement is coming from.
You're thinking of a single log message. It's a single thing that can happen
out of the blue, but they won't be happening all that often; you're paying
attention to each one, each one is a distinct, totally isolated event, and
there's no concept of a stream of messages because messages are unrelated to
each other.
I'm thinking of a potentially high-volume stream of messages, where there's an
enormous win in aggregating them; each message doesn't need to be separately
authenticated and so forth; messages arrive at the server in the order in
which they were dumped into the pipe by the client; brief bursts that exceed
the capacity of the net in between are handled gracefully; etc.
In other words, you're thinking of the kind of goo that gets appended to
/var/log/messages by a single well-tuned and healthy system; I'm thinking
about the kind of accumulation you see if hundreds of clients are all beaming
all their logs at one server, and some they're wired to log everything, in
exquisite detail.
There are probably uses for both visions. But yours doesn't solve any problem
that I have with the current syslog:-).
-Bennett
