Greg Sarsons wrote: > > > > Is anyone using or has used mdk 8.1 as remote syslog? I'm trying to > > > figure out why there seems to be gaps in the logs on the 8.1 machine. > > It logs all the packets I'm seeing which is good but it looks like the > router is not logging properly :(
The router must have a sequence number on each log entry for you to notice this, or is there some other means...? Ways for a router to fail to log remotely include: - the path over which to send the log data is temporarily down - logging packets may be dropped by intermediate nodes Logging is done blindly AFAIK -- send and hope the logger got it... so if another router is in the path next to the logging host, that local router can time out its ARP cache which will cause an incoming log message to be converted to an ARP request to repopulate the ARP cache... the problem being that the log entry is not retried; hence lost... If logging from a particular router is critical, then the logging host should be local to avoid this situation. HTH, Pierre
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
