Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: fix broken markdown in "UDP vs TCP" block #2286

Merged
merged 2 commits into from
Dec 11, 2023
Merged

docs: fix broken markdown in "UDP vs TCP" block #2286

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3fe5ad8
docs: fix broken md in architecture page
ikheifets-splunk Dec 11, 2023
b0ce707
Merge branch 'main' into fix-doc-markdown
ikheifets-splunk Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ Run your syslog configuration on UDP rather than TCP.
The syslogd daemon was originally configured to use UDP for log forwarding to reduce overhead, as UDP's streaming method does not require the overhead of establishing a network session.
UDP also reduces network load on the network stream with no required receipt verification or window adjustment.
Although TCP uses ACKS and there should not be data loss, loss cann occur when:

* The TCP session is closed: Events published while the system is creating a new session are lost. (Closed Window Case)
* The remote side is busy and can not ACK fast enough: Events are lost due to a full local buffer.
* A single ACK is lost by the network and the client closes the connection: Local and remote buffer are lost.
Expand All @@ -55,6 +56,7 @@ Although TCP uses ACKS and there should not be data loss, loss cann occur when:

Use TCP if the syslog event is larger than the maximum size of the UDP packet on your network typically limited to Web Proxy, DLP, and IDs type sources.
To decrease drawbacks of TCP you can use TLS over TCP:

* The TLS can continue a session over a broken TCP reducing buffer loss conditions.
* The TLS will fill packets for more efficient use of wire.
* The TLS will compress in most cases.