Hacker News Reader

Interesting TCP is recommended with pain old Syslog. I've seen that take out systems due to not being able to dequeue. There are better protocols that you can use for reliable delivery

View on HN

What would be an alternative option?

There's RELP[1] but if you can don't use syslog's protocol. You could use something like the beat protocol (if using ELK stack) or just a plain old message queue. Things like logstash (and fluentd etc) can have multiple input/output targets.

You'd have something like filebeat or fluentd reading the logs locally and then shipping via that protocol to a central system where they'd be ingested. For application logging, definitely use structured data (like JSON, for example) over log-lines. It's easier to parse in the long-run.

1: https://en.wikipedia.org/wiki/Reliable_Event_Logging_Protoco...

RELP also uses TCP, so how would that help in a situation where Syslog over TCP doesn't work?

REPL != Syslog TCP. They're different things. It's not TCP that was the issue but the implementation of syslog on top.

Reply on news.ycombinator.com