Hi Carson,
At 11:41 AM 10/27/00 -0700, Carson Gaspar wrote:
>[Re: messages never leaving the box, multiple counters, etc.]
>
>Ummm... why not just have one counter per syslog host/local file, and increment
>message numbers that actually get sent? For a dumb box, it only supports one remote
>syslog host, and only needs one counter.
That would work and I'm not opposed to it if the rest of the WG also
agrees. I just want to make sure that we all understand the situation
before we go down this path. Let's say that we do have a small device
that can only be configured to send syslog messages to one syslog
server. It would then sequentially number everything sent. The syslog
server would receive them and could verify that they had the correct
MAC on them. That server could then file some of the records in file
A, some other records in file B, and could send some along to the next
server. That's not too outlandish as some people do have servers set
to receive and log every message as well as passing along the "more
important" ones (alert and above) to a "higher level" syslog server.
When the "more important" messages are filed in the 'next' server, there
will be gaps in the sequence.
The alternative may be something like this. If the small box has
enough 'oomph', then the administrator could say that it will use its
system counter for all outgoing messages. It could also use a separate
counter for messages of alert level and above. Then, when they reach
the first syslog server, they will be stored in sequential order. Also,
when the "more important" messages reach the 'next' syslog server, their
additional sequence number will also order them.
>Boxes that support many logging outputs need multiple counters, but thay should be
>able to handle it.
Should they have one "global" counter on the box and then "secondary"
counters for each output? ..or should they just have a counter
associated with each output queue?
>Am I missing something?
I don't think so. I just want to make sure that we cover this _once_
and agree upon the direction. :-)
Thanks,
Chris
