If this is just for reporting, I'd consider using High Speed Logging to send a log message to a remote pool of syslog servers for every request and/or response. The CPU/memory/I/O overhead for HSL is quite low compared with using a subtable and logging locally. In informal testing on an 8900 I saw up to 200k TCP or UDP messages of 1000 bytes sent with ~10% CPU increase and nearly no additional memory usage. The additional CPU was much lower at lower message levels.
As Hamish pointed out in a recent thread here, it would be good to upgrade to the latest 10.2.x release when using HSL as there have been some bugs fixed in this version.
Aaron
Aaron
Nimbostratus
