On Thu, 30 Aug 2007, Peter J. Holzer wrote:
On 2007-08-29 17:50:28 -0400, Charlie Brady wrote:
A four-tuple identifying the TCP connection also identifies the server.
Right. And the tuple must not be reused for some time (2*MSL or 4 minutes
according to RFC 793), so you don't even need a high resolution timer.
Indeed.
However, what if there is no TCP connection yet? For example, in
forkserver, the plugins are loaded before the first connection is
accepted and you want to log a failure to load one of them (or the
plugins may want to log something in their register method).
I consider that to be a different issue. Log messages at that stage aren't
related to and don't need to be correlated with an email message.
You could just fill the remote part with zeros, but you can have
multiple processes listening on the same port and you can't distinguish
them in this case.
You can't have multiple processes bound to the same
local_IP/local_port, so you could distinguish hosts and processes by
filling in the local part of the four-tuple. There's still an edge case
where multiple processes are started with the same local port
configuration, all but one of which will fail. Do we really ever expect to
be merging logs from such errant processes?
