Sending syslog-ng over Data Diode UDP to FreeBSD syslog-ng, proved to be unstable/unreliable. After certain amount of traffic or whatnot, the packets are just dropped in kernel until restart. Buffer size can post-pone this but one never knows when.
Apparently, according to clankers...
Linux handles high-rate and bursty UDP traffic significantly better than FreeBSD. Linux provides much more robust multi-core scaling, massive socket-buffer ceilings, and native multi-socket load balancing (SO_REUSEPORT) that allows syslog-ng to process traffic in parallel. Enterprise versions of syslog-ng even leverage eBPF-based UDP balancers to eliminate packet drop bottlenecks entirely.
Ironically Berkeley Packet Filter was super-tuned in Linux kernel in to eBPF, better able to handle UDP bursts.
Another project I'd like to use FreeBSD for, is shattered. Maybe I keep it on the TCP side of pipeline.
Apparently, according to clankers...
Linux handles high-rate and bursty UDP traffic significantly better than FreeBSD. Linux provides much more robust multi-core scaling, massive socket-buffer ceilings, and native multi-socket load balancing (SO_REUSEPORT) that allows syslog-ng to process traffic in parallel. Enterprise versions of syslog-ng even leverage eBPF-based UDP balancers to eliminate packet drop bottlenecks entirely.
Ironically Berkeley Packet Filter was super-tuned in Linux kernel in to eBPF, better able to handle UDP bursts.
Another project I'd like to use FreeBSD for, is shattered. Maybe I keep it on the TCP side of pipeline.