RE: Re: Syslog and Windows

Hi Tina,
 
> It is, as far as I've seen, clear that syslog *server* 
> implementations for
> UNIX variants offer far more features and robustness than the 
> syslog servers
> for Windows, although I must confess to little experience with Windows
> syslog servers. Mostly I'd worry about their ability to 
> perform under load,
> especially if they're moving syslog data into the pre-Vista Event Log
> service.

This is a call for me ;) [all others: remember my Adiscon vendor hat -
MonitorWare and WinSyslog]

I of course second Gord's words on feature set. So I just pick the
performance issue. Of course, you need to forget about putting syslog
messages to the event log. That's slow and storage space is severely
limited. How many seconds worth of data will the (tuned) event log hold
at few thousand messages per seconds. 

So let's get serious and store message to either a database or (for
really high volumes) to text files. Our solutions are highly tailored to
handle traffic bursts and perform at very high rates. Actually, I'd say
that, given same hardware ressources and scenarios (message length,
complexity of rules), WinSyslog and MonitorWare will probably outperform
most (if not all ;)) syslogds, be it on Windows or *nix. Of course I am
exagragating... But I am also a performance hog. We are very commited at
providing very high throughput and I think we so far have done quite
good at it.

But it is not just the software: there are a lot of factors. I've done a
writeup some time ago and it is still relevant:

http://www.monitorware.com/Common/en/Articles/performance-optimizing-sys
log-server.php

This brings us also to a root problem: I guess that most of the really
knowledgable folks run sylsogds on *nix. In the Windows space, people
seem to care less about optimizing the system, thinking about rules and
all that. The result is that the *nix syslogds are often running in a
better optimized environment - and thus are running faster.

Of course, all of this is biased. But keep in mind that I am also
working in the *nix space with the rsyslog project. Of course, it is not
as perfect as the tools I am working on for more than 10 years. But it
is evolving rapidly and already has a very wide feature set.
Performance, too is on the agenda, but there is still some room for
improvement.

Rainer