Log unique Client Addresses per (Hour|Day|Etc)

Using TCP is a stream of data (No loss). But the buffers are tiny. When they fill up (i.e. receiver can't keep up), the LTM opens a NEW connection to the logging pool... Then when the pool is busy and can't keep up, you get an endless spiral where the number of HSL connections quickly brings everything to it's knees (I had it up to thousands of connections :). WHich rapidly gets messy as it can take a LONG time to process all those streams. WHich uses up all that memory you're trying to avoid in not using the tables in the first place.

 

 

Hey Hamish,

 

 

What kind of syslog servers were you using? If you increased the pool of servers, did you see better results?

 

 

I tested using an set of LTMs to act as a syslog pool. I saw less than 1% loss of messages up to 200k messages/second as long as I had a big enough trunk and pool of servers available to receive the syslog messages. Granted logging 1k messages x 200k messages / second to disk would require a beefy collection of syslog servers.

 

 

Aaron