RE: Log Generator

"Marcus J. Ranum" <[email protected]> Tue, 29 Jan 2008 15:39:28 -0500
Newsgroups gmane.comp.sysutils.loganalysis
Message-ID <[email protected]>
Just as an FYI - if you're stress-testing a logging system, first
load it up with something that outputs sequence numbers, then
check the sequence numbers on the backend for drop-outs.
With UDP syslog there are multiple points where the system
(udp output queues, network devices, udp input queues, etc)
feels justified in throwing away log traffic.

I did some stuff with this "back in the day" and my numbers
would no longer mean anything. But I was surprised as hell
when I was syslogging a ton of stuff on one machine and
noticed in tcpdump that the box was only sending 1/10 as
many packets as I expected...

mjr.