5 ms·

Wonder what the advantage over just plain syslog is

by fidget 11y ago

hardwaresofton 11y ago
IIRC, syslog is slower than file I/O, so I imagine one of the main benefits is speed (ZMQ is completely in memory)
- fidget 11y ago
  Which syslog?
  - hardwaresofton 11y ago
    All syslogs that write to files/sync non-optimally? There is of course the risk of dropped messages on machine failure but I think it's pretty safe to assume that at that point you're doing what ZeroMQ was going to do anyway I should clarify syslog, with naive configuration, is slower than file I/O because it does stuff, then writes to disk. feel free to correct me if I'm wrong
- lobster_johnson 11y ago
  Rsyslog has all sorts of input and output drivers, and can be set up without a spool directory, so that it's all in-memory. Don't know about syslog-ng, I'm sure it has similar support.
  - hardwaresofton 11y ago
    I stand corrected then! I have to say I don't have a huge amount of experience with syslog, but after a little bit of resarch it looks like it does support mostly in-memory (with some sync to disk) logging.
    - lobster_johnson 11y ago
      Syslog is just a network protocol. There are a whole bunch of implementations; there's nothing in the protocol that says it has to end up on disk.
      - fidget 11y ago
        > Syslog is just a [family] of network protocols[, most informally specified.] syslog-ng (my syslog of choice) has 3 'syslog' network protocols. `tcp`/`udp`, `network`, and `syslog`. Now lets play 'match the syslog-ng name to the rfc` (or lack thereof)!
        lobster_johnson 11y ago
        Syslog didn't start out as a standard, and the RFCs basically just try to formalize what was already implemented in OSes. It's a big mess. The protocol itself is not... great.
        frobert 11y ago
        Hi, regarding syslog-ng and RFCs: - The udp driver is RFC3164, the original syslog protocol (also called BSD-syslog) - tcp driver is the same, just uses tcp instead of udp - the network driver is just a wrapper for the tcp+udp drivers (it also supports TLS-encryption) - the syslog driver uses the newer syslog protocol, RFC5424. HTH, Regards, Robert syslog-ng documentation maintainer
MichaelGG 11y ago
Eh supporting newlines might be a good reason.

Wonder what the advantage over just plain syslog is

by fidget 11y ago

Wonder what the advantage over just plain syslog is

hardwaresofton 11y ago

IIRC, syslog is slower than file I/O, so I imagine one of the main benefits is speed (ZMQ is completely in memory)

fidget 11y ago
Which syslog?
- hardwaresofton 11y ago
  All syslogs that write to files/sync non-optimally? There is of course the risk of dropped messages on machine failure but I think it's pretty safe to assume that at that point you're doing what ZeroMQ was going to do anyway I should clarify syslog, with naive configuration, is slower than file I/O because it does stuff, then writes to disk. feel free to correct me if I'm wrong
lobster_johnson 11y ago
Rsyslog has all sorts of input and output drivers, and can be set up without a spool directory, so that it's all in-memory. Don't know about syslog-ng, I'm sure it has similar support.
- hardwaresofton 11y ago
  I stand corrected then! I have to say I don't have a huge amount of experience with syslog, but after a little bit of resarch it looks like it does support mostly in-memory (with some sync to disk) logging.
  - lobster_johnson 11y ago
    Syslog is just a network protocol. There are a whole bunch of implementations; there's nothing in the protocol that says it has to end up on disk.
    - fidget 11y ago
      > Syslog is just a [family] of network protocols[, most informally specified.] syslog-ng (my syslog of choice) has 3 'syslog' network protocols. `tcp`/`udp`, `network`, and `syslog`. Now lets play 'match the syslog-ng name to the rfc` (or lack thereof)!
      - lobster_johnson 11y ago
        Syslog didn't start out as a standard, and the RFCs basically just try to formalize what was already implemented in OSes. It's a big mess. The protocol itself is not... great.
      - frobert 11y ago
        Hi, regarding syslog-ng and RFCs: - The udp driver is RFC3164, the original syslog protocol (also called BSD-syslog) - tcp driver is the same, just uses tcp instead of udp - the network driver is just a wrapper for the tcp+udp drivers (it also supports TLS-encryption) - the syslog driver uses the newer syslog protocol, RFC5424. HTH, Regards, Robert syslog-ng documentation maintainer

MichaelGG 11y ago

Eh supporting newlines might be a good reason.