A prioritized retransmission mechanism for reliable and efficient delivery of syslog messages

Logs generated by operating systems and application programs provide important information to a network administrator. Logs are used for various purposes including security management, audit, and forensics of intranet. To use logs for such purposes, it is important that logs are reliably retrieved from hosts in the intranet. But the syslog protocol which is widely used for network logging does not meet this requirement. Thus, the use of TCP for improving the reliability is being standardized at the IETF. However, TCP is not effective for providing the reliability in terms of cost and delay. In this paper, we examine the issues and requirements of network logging based on experiments in a real network environment and point out problems of TCP. Then we propose an efficient mechanism for the reliable delivery of syslog messages and validate its effectiveness thorough NS-2 simulations.