Forum Discussion
chester_16314
Sep 08, 2011Nimbostratus
Log unique Client Addresses per (Hour|Day|Etc)
I have an iRule to log client GEO Location data. However, I don't want to log every single client accepted or http request out. Maybe I'm silly, but that seems like a lot of extra thrashing when all...
hooleylist
Sep 12, 2011Cirrostratus
Using TCP is a stream of data (No loss). But the buffers are tiny. When they fill up (i.e. receiver can't keep up), the LTM opens a NEW connection to the logging pool... Then when the pool is busy and can't keep up, you get an endless spiral where the number of HSL connections quickly brings everything to it's knees (I had it up to thousands of connections :). WHich rapidly gets messy as it can take a LONG time to process all those streams. WHich uses up all that memory you're trying to avoid in not using the tables in the first place.
Hey Hamish,
What kind of syslog servers were you using? If you increased the pool of servers, did you see better results?
I tested using an set of LTMs to act as a syslog pool. I saw less than 1% loss of messages up to 200k messages/second as long as I had a big enough trunk and pool of servers available to receive the syslog messages. Granted logging 1k messages x 200k messages / second to disk would require a beefy collection of syslog servers.
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects