On Dec 23, 2009, at 9:27 PM, Mark McCullough wrote: > Yes, we periodically review the logs that would be very obvious if any events > are missing, and have yet to find a missing log event.
I thought the same thing, while I was managing the network of Internet e-mail gateways for AOL that were using high-speed FDDI connections. It wasn't until I compared local logs for a slice of time across a selection of gateways to the data that had been recorded on the central log server for those same machines for that same period of time, that I saw the data loss. The network never showed any errors -- no runts, drops, congestion, or anything else (it was FDDI after all), but the data loss was there. And we were generating gigabytes of mail log traffic per day, even with the 75% data loss. Maybe you're not losing any data. Maybe you are. You won't know for sure unless you compare local logs that are written at the same time as the network logs for the same data, and then you do a comparison. And even then, you might not see loss at a particular time, but perhaps there is a loss at another time that you don't see. -- Brad Knowles <[email protected]> LinkedIn Profile: <http://tinyurl.com/y8kpxu> _______________________________________________ Tech mailing list [email protected] http://lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
