Andrew & WG,
a follow-up to my own posting, just some extra information.
> > When mapping over plain TCP I believe we should limit the
> > total message size
> > to 65507 bytes (to keep it compatible with UDP) and delimit
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Anton and other already cautioned against using too-large UDP message
sizes. I just want to throw in some of our practical experiences. I've
done some testing on Windows and Linux, and the result is that UDP
practical maximum tends to be around 4K. It is documented here:
http://www.monitorware.com/Common/en/articles/ihe-syslog.php
Of course, other software might modify the IP stack with different
parameters. The rsyslogd I have tested with is derived from stock Linux
syslogd, so that quite popular system is experiencing the same issue.
While I always tell we need to allow larger-size messages, we need to be
very careful when thinking about UDP. My testing did not even look into
message loss and out-of-order delivery. For UDP, I consider the
practical upper limit to be 4K.
Rainer
_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog
