<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>Thanks for the suggestion. Sending it over to the docs team.
<br>
<br>----- Original message -----
<br>> > Hmm. the numbers you are seeing are indeed low, with sufficient buffer
<br>> > sizes I could get up to the 20k message/sec range with syslog-ng...
<br>>
<br>> It's better now, having adjusted the buffer sizes way up.  I'd like to
<br>> recommend a change to the documenation.  In section 7:
<br>>
<br>>  
<br>> <a href="http://www.balabit.com/sites/default/files/documents/syslog-ng-admin-guide_en.html/handling_large_load.html">http://www.balabit.com/sites/default/files/documents/syslog-ng-admin-guide_en.html/handling_large_load.html</a>
<br>>
<br>> The issue of buffer size is addressed like this:
<br>>
<br>> "This section provides tips on optimizing the performance of
<br>> syslog-ng. Optimizing the performance is important for syslog-ng hosts
<br>> that handle large traffic... When receiving lots of messages using the
<br>> UDP protocol, increase the size of the UDP receive buffer on the
<br>> syslog-ng hosts."
<br>>
<br>> I would suggest that with the default Linux kernel values for UDP
<br>> receive buffer size, adjusting the UDP receive buffer size is
<br>> necessary to get performance above "crappy".  That is, this isn't just
<br>> a necessity for "high volume" sites; it should probably be a
<br>> recommended practice for anyone planning on accepting UDP syslog
<br>> messages on a Linux host.  Making this more prominent in the
<br>> documentation might save a lot of people from the rude surprise that
<br>> comes with the default buffer sizes.
<br>>
<br>> Things are running much better now having made these changes.  I'm
<br>> going to write up the performance test I did in a little more detail
<br>> and stick it online somewhere, hopefully saving someone else a little
<br>> bit of time in the future.
<br>>
<br><br></p>
</body>
</html>