| Subject: | Add documentation on the need for eval around ->send |
We've recently started using L:S:Fast at ce.com.au for deep metrics
capture from a large web application.
The pattern we're using is that the metrics code dumps UDP packets to
localhost, the syslog daemon grabs them from the UDP port, echos to
disk, and forwards on to the corporate syslog server.
This has been working brilliantly well through development, right up
until we ran it on our staging server.
Because our Linux admin was away for the week, the code got pushed to
those servers without enabling the UDP listener on localhost (with his
blessing, after all it's UDP packets and they'll just dissapear if
there's nothing listening).
Only problem is, we're seeing the ->send calls throwing die exceptions.
What seems to happen is this...
1. ->new called to create the syslog socket. No error.
2. ->send called the first time to send message. No error.
3. ->send called the second time to send message. Error/exception thrown.
It seems what is happening is that the ICMP destination unreachable for
the first UDP packet is making the kernel think the socket is dead. This
response arrives shortly after the first message is sent, so when the
second message sends, we get the error.
Normally, this wouldn't be a problem because the firewall would have
filtered out those ICMP packets or something. But because it's on
localhost, this isn't happening.
So we've discovered that if you are going to reuse one syslog handle to
->send many messages, and you are using UDP for it's fire-and-forget
ability, you absolutely have to wrap an eval { } around every call to
->send, otherwise you risk you application exploding violently if the
syslog server is ever shut down or restarted.
It might be worth documenting something along these lines, or
alternatively it would be nice if the module didn't throw exceptions
when using UDP.
Operating system in this case is RedHat 4, but I imagine that behaviours
in this regard could easily differ on different operating systems.