[Discuss] Log management options?

[gaf at blu.org (Jerry Feldman)]

On 03/17/2012 01:40 AM, Scott Ehrlich wrote:
> I need tcp communication (vs udp) to ensure messages successfully get
> passed from client to log server.
I'm not going to comment directly on the log server, but on the use of
UDP. At one point I was part of a team to write SNMP agents for various
Unix hosts so Digital could manage a large network. One of the reasons
for NOT using TCP was very simple: If a remote host failed, the TCP
process could hang or at least wait for a timeout. While UDP does not
guarantee delivery and the sending host is not notified of a failure,
the application can implement a reliably system using UDP.  In the case
of SNMP, the server would send messages to the clients, and expect the
clients to respond. But because of the different networks and speeds,
the responses can come back in many different times. The application
handles this very well. If one of the clients fails to respond in a
given window SNMP will mark that client as offline.  So, basically your
requirement is a reliable network.

There are many logging solutions available. Here is one that might
require some work: Enhance Security with a Linux Logging Server:
http://goo.gl/gb0tU



-- 
Jerry Feldman <gaf at blu.org>
Boston Linux and Unix
PGP key id:3BC1EB90 
PGP Key fingerprint: 49E2 C52A FC5A A31F 8D66  C0AF 7CEA 30FC 3BC1 EB90