1. Scheduled forwarding
2. Bandwidth management
3. Buffering to disk

When using continuous forwarding there is still a delay when forwarding data. This is because the data is always buffered to disk into a file. This file is sent every 5 minutes to the destination appliance which creates a 5 minute gap between each transmission. This occurs at every hop where LLTCP is used.
As a result of 5 minutes worth of data being transmitted all at once it will also be processed all at once. This can place additional load on the destination system every 5 minutes instead of allowing that load to be reduced but spread over a larger time period by using syslog to stream the data in real-time.

LLTCP is recommended only for environments that require LMI appliances to communicate over unreliable or slow links just because there is added overhead when using any file-based protocol compared to UDP syslog.

There is one scenario that requires the use of LLTCP and that is when you have file-based data collected by a LogLogic LMI appliance that must be forwarded to another LMI appliance while remaining file-based data. LLTCP will retain the file-based nature of the event data because LLTCP only operates with files anyway. The reason for needing the data to remain as file-based data when being forwarded is to support the destination LMI appliance with properly identifying the source type of the event data and to provide deep parsing capability for later parsed reporting. if you do not need the downstream LMI appliance to properly identify the source type of the event data or to deep parse the data then the file-based data can be forwarded using syslog instead.