[Spread-users] Right configuration for loging (mod_log_spread)

Ryan Caudy caudy at jhu.edu
Fri Aug 8 12:05:07 EDT 2003

Caveat: I'm not very familiar with mod_log_spread.

The advantage of using Spread to carry log traffic is that you can 
replicate the log many places, without a separate network transfer for 
each location.  In a perfect world (no retransmissions needed), this 
means that the data you log goes out on the wire once, accompanied by a 
header from Spread and some other traffic.  You should be seeing an 
increase in traffic at each server running spread that roughly 
corresponds to the data you're logging (allowing for overhead due to 
Spread's header information (probably just 48 bytes per spread message), 
and token/protocol traffic).  Each Spread daemon will receive each 
message that is sent by the system, and deliver it to clients (in your 
case, if I understand correctly, via IPC) if necessary.

I think that your setup in terms of the number and placement of Spread 
daemons is correct.

If you're seeing lots of extra traffic at other machines, my guess is 
that you are using a broadcast address for your Spread segment.  If you 
have lots of machines not running Spread, it may be advantageous to use 
multicast in order to have these other machines discard the messages 
sent by Spread at the hardware level.


Jose R. Ilabaca wrote:
> I've being reading the list's archives and also mod_log_spread list's
> archives. I've been testing with real load and I'm not still sure about
> the right configuration for me.
> I'm planning to have aboyut 10 web servers which will log about 40 lines
> per second each and 2 servers for storing and processing the logs.
> After the readings I configured 1 ring with the 12 servers IP and the
> mod_log_spread defining 2 groups, so each of 2 loggers will have two log
> files, one for each group (using spreadlogd), but process only one. In
> this way if one log server fails I'll still have the complete log of
> both groups.
> I started with spread in only 2 web servers and 1 log server (all 3
> spread.conf are the same, have the three servers on it). I configured 1
> web server to start loging to spread and I was surprised about the
> network traffic generated. So now I am not sure that the configuration I
> decided was right. The server that has the web server loging to his
> local spread server doubled the network traffic (which was expected, but
> only the outbound traffic, not both!), but also the other web sever
> doubled the network traffic, and it only has a spread daemon running,
> the web server is not communicated with it, and has no spread client
> running. Also other servers not involved in spread are receiving about
> 200 Kb/s of traffic...
> So, the questions are: 
> -Is this network behavior as it supposed to be?
> -Is the configuration right?
> _______________________________________________
> Spread-users mailing list
> Spread-users at lists.spread.org
> http://lists.spread.org/mailman/listinfo/spread-users

Ryan W. Caudy
Center for Networking and Distributed Systems
Department of Computer Science
Johns Hopkins University

More information about the Spread-users mailing list