Chris Lonvick wrote:
> It needs to be "Resend" as these are redundant. Let me give
> a very simple case to show:
> If we configure the sender to have:
> - a Signature Block Count (CNT) of 50
> - sigRepeat=2
> - sigResendDelay=30sec
> - sigResendCount=34
> then:
> time Sender Collector
> 0s ---syslog messages 1-50--->
> 14s ---sig block for msgs 1-50--->
> 44s ---syslog messages 51-60--->
> 44s ---sig block for msgs 1-50---> (R1,1)
> 52s ---syslog messages 61-95--->
> 52s ---sig block for msgs 1-50---> (R1,2)
> 60s ---syslog messages 95-100--->
> 60s ---sig block for msgs 51-100--->
>
>
> For the first 14 seconds, the device sends 50 messages and then the
> Signature Block for them. Thirty seconds later, the sigResendDelay
> timer trips to send the first redundant Signature Block of the first
> 50 messages - shown as (R1,1). Eight seconds after that, the sender
> sees that it has sent 34 messages since sending out the previous
> redundant Signature Block so it sends out the second redundant
> Signature Block of the first 50 messages - shown as (R1,2).
Thanks for the explanation -- I think I now understood this!
> I do take your point that there is nothing to kick out the initial
> signature block on a slow system. Same example:
> time Sender Collector
> 0s ---syslog messages 1-47--->
> ...eight years later, still nothing else...
>
> So there should be a sigMaxInterval.
>
> I would rewrite it as follows:
> ===
> 6.1.2. Configuration Parameters for Signature Blocks
>
Perhaps we should deal with non-redundant signature blocks first,
and retransmissions afterward? How about:
The following parameters control how often Signature Blocks are
generated (note that the maximum message length may also force
generating a Signature Block; see Sections 4.2.6 and 4.2.7):
sigMaxInterval = generate a new Signature Block if this many seconds
have elapsed since the previous new Signature Block (not counting
retransmissions). Note that this applies even when no other syslog
messages have been sent since the previous Signature Block.
sigMaxCount = generate a Signature Block if this many other syslog
messages have been sent since the previous new Signature Block
(not counting retransmissions).
(Changed "send" to "generate" here)
> To ensure reliably delivery (see Section 8.5), it is useful to send
> the same Signature Block multiple times. This is controlled by the
> "sigRepeat" parameter:
>
> sigRepeat = number of times a Signature Block is resent.
> It is RECOMMENDED to use a value greater than 0 in particular
> when the UDP transport [RFC5426] is used.
>
> The following parameters control how often the redundant Signature
> Blocks are sent.
How about:
The retransmitted Signature Blocks are not sent immediately after
the original transmission, but slightly later. The following
parameters control when the retransmissions are done (note that
these are independent of the parameters controlling when new
Signature Blocks are generated):
> sigResendDelay = send a redundant Signature Block if this many
> seconds have elapsed since sending the original Signature
> Block, or any previous redundant Signature Blocks.
How about:
sigResendDelay = retransmit if this many seconds have elapsed
since the previous sending of this Signature Block.
("any" could refer to any Signature Block, even a new one.)
> sigResendCount = send a Signature Block if this many other
> syslog messages have been sent since sending the original
> Signature Block, or any previous redundant Signature Blocks.
How about:
sigResendCount = retransmit if this many other syslog messages have
been sent since the previous sending of this Signature Block.
Best regards,
Pasi
_______________________________________________
Syslog mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/syslog
