Re: [Syslog] Discuss - Congestion Control

[Eliot Lear <lear at cisco.com>]

Chris, Magnus,
> Response from Magnus:
> This mostly addresses my concerns. I still think there is one major 
> issue around this with congestion control. And that is
> some description on how to rate-limit your traffic. Either in UDP to 
> some pre-configured threshold and in the case of TLS
> over TCP the rate actually available. There can occur situations where 
> the amount of generated data will be larger than
> what can be transfered. How does one resolve this? I think it probably 
> needs to be more text in syslog-protocol spec about this. How to use 
> scope and prio to determine which messages to throw away or queue up 
> (within limits).


Most sources of potentially voluminous syslog messages have a rate limit 
mechanism already in as much as they will aggregate messages (the old 
"Last message repeated N times" thing).  I propose that we add some 
wording along the lines of the following in syslog-udp:

   syslog generator implementors must be mindful of the downstream
   resources their messages will consume, both from a network and
   server standpoint.  A single syslog source that has the capability
   to produce a flood of messages should aggregate and rate limit them
   in some appropriate fashion.  An event count combined with rate
   limiting has been used very successfully in the past.

How about that?

_______________________________________________
Syslog mailing list
Syslog at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog