Brad Knowles wrote:
> On Dec 23, 2009, at 6:30 PM, Nicholas Tang wrote:
>
>> You could probably also log to Syslog and have it
>> write those logs to a remote Syslog server rather
>> than writing them locally. That won't require a
>> network-aware logging module.
>
> The disadvantage to remote syslog is that the default
> protocol is UDP, and in my experience is very sensitive
> to latency.
Not latency, but buffer overruns. We had a java app that
we were writing. We had it send UDP syslog to localhost.
(Coder preferred that instead of JNI to the syslog lib.)
We got about 50+ percent packet loss. We had to put a
delay in the logging thread, between packets.
The standard syslog() library uses Unix domain datagrams,
which have a guaranteed delivery. Trouble is that the
process/thread will block, until delivery happens.
> On networks that were less than 1% utilized,
> I've seen UDP syslog drop over 75% of all the log data.
> Packages like syslog-ng allow you the option of doing
> syslog over a TCP connection, but that also has some issues.
Here you have the same buffer overruns, just that it is pushed
to the client syslog-ng. syslog-ng is designed to drop older
messages in its queue if the TCP socket is being blocked.
>
>> Both of those solutions have the added advantage of
>> allowing you to log multiple webservers' logs to a
>> single physical machine and log, making it easier to
>> analyze them later.
>
> It's actually easier to combine things later and keep
> them separate earlier in the process. Once they streams
> are merged, it can be difficult or impossible to separate
> them out again.
This is easy, if thought of beforehand. You just need to
tag the log messages with the original host. This is
simple with apache's custom logging. Or, if using syslog-ng,
it can be done in the syslog process.
--
END OF LINE
--MCP
_______________________________________________
Tech mailing list
[email protected]
http://lopsa.org/cgi-bin/mailman/listinfo/tech
This list provided by the League of Professional System Administrators
http://lopsa.org/
