On Mon, 10 Feb 2014, Assaf Gordon wrote:
On 02/10/2014 04:12 PM, David Lang wrote:
On Mon, 10 Feb 2014, Assaf Gordon wrote:
2. When using UDP servers or Unix sockets, the limitation is worse:
400 bytes for the message (This is related, I assume, to the inherit
limit of 576 bytes per atomic UDP datagram).
huh??? I've sent much larger logs via UDP without a problem, and
/dev/log is a Unix socket, so if this was true then logger would be
limited to 400 bytes.
Perhaps there are different implementation issues (or perhaps I missed
something), but this is what I've observed (on Ubuntu and Debian).
1. Ubuntu and Debian use "logger" from "bsdutils", which has the following
line when logging through Unix/UDP sockets:
snprintf(buf, sizeof(buf), "<%d>%.15s %.200s%s: %.400s",
pri, tp, cp, pid, msg);
Where "msg" is truncated to "%.400s" .
Same is in "mlogger" ( https://github.com/nbrownus/mlogger ).
I can easily believe that logger does silly things
3. When using a unix-socket, it should be possible to reliably send larger
messages, as the kernel guarantees some atomicity.
I could not find an authoritative number, but to the best of my
understanding, opening a unix socket with "socket(AF_LOCAL,SOCK_DGRAM,...)"
you can send messages that are upto "SO_SNDBUF" in size, commonly ~120KB on
linux.
(if someone knows differently, please correct me).
4. When using a UDP socket, the maximum size you can use and still guarantee
that there will be no IP fragmentation is about 576 bytes (which, counting IP
header and syslog headers, brings it down to a safe "ball-park" value of 400
bytes, which is what the limit is in the C source files).
fragmentation works on UDP messages into packets, and UDP packets can be any
size up to the MTU of your network. so you can send a 4k message over UDP
without using jumbo packets.
now, if your network is busy and there is a risk of loosing packets, a message
that gets fragmented into multiple packets will be lost if any of the packets
are lost.
You can (usually) set your network MTU up to ~8k and send 8k messages via UDP
with very little chance of you loosing any logs (and in practice, UDP over a
local switch is going to be pretty darn reliable anyway, up to the wirespeed
limits of your switch)
all you need to do to send large messages over UDP is to set the message size on
sender and receiver (up the max size compiled into rsyslog) and make sure that
you don't use a template that trims the message to a given size.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
