> > As I said before, I like the idea of being able to reconcile counts, > but fear it > > may end up too complex to implement since, to do it properly, you > would need to > > extract such tables from potentially every syslog stack in the > management domain > > at the same point in time and then later repeat the process in order > to get a > > diff between the counters; and then start reconciling. > I will agree with you. Reconciling the counts of multiple applications, > possibly on multiple servers, is complex. I would say it is impractical > if not impossible.
I fully agree - it is (close to) impossible. Most importantly, in practice admins discard a number of messages. So you can not simply look at messages send/received - you also need to know which messages need to be collected and which ones need to be relayed. In short, you need to pull config information in addition to the pure tables (because the tables do not reflect internal processing). Then keep in mind, that probably every vendor has different filtering capabilities and methods... I have to admit that I find this whole discussion on consolidating counts counter-productive. You do not get any useful information out of it, but for the sake of it everything else gets complicated and delayed. Over-engineered IMHO.... Rainer _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
