huxi / lilith

Lilith is a Logging- and AccessEvent viewer for Logback, log4j, log4j2 and java.util.logging
http://lilith.huxhorn.de
GNU Lesser General Public License v3.0
137 stars 18 forks source link

ServerSocketAppender and Lilith #14

Closed Ferada closed 10 years ago

Ferada commented 10 years ago

Hi, so I'm evaluating Lilith and integrating it as a test in a server application. While doing that, I'm trying to figure out: Is the limitation to not connect to a remote host, e.g. with a ServerSocketAppender, intentional, or a architectural limitation?

The server in question won't always be connected to the local log viewer, so I don't see why it should basically poll for a connection every other moment. For the moment I'm probably going to write logs to files and transfer those around, but connecting to get a current view would obviously be easier.

huxi commented 10 years ago

Oh yes, this is indeed intentional.

One pragmatic reason is that it would require significant additional UI (server config, bookmarks).

But more importantly: the use of ServerSocketAppender in an application would open up a very simple DoS opportunity. One would simply have to connect to the port and read the data very, very slowly. This would result in an hanging application. It would essentially grind to a halt on every logging call that would like to send an event and it would stay frozen until the connection has a timeout - which can be prevented by the above "very, very slowly" instead of simply reading nothing at all.

I opted to not encourage people shooting themselves in the foot like this. That this also saved me some work was an added bonus. :)

You could still set a reasonably high reconnection delay on the SocketAppender - performance impact should be negligible.

Ferada commented 10 years ago

Okay, thanks for the explanation.