Thanks Gergely and Bazsi!!<br><br>My problem is that I don't have a test lab. Everything I try is in production. I finally am getting a lab set up but we are looking at several weeks out. I will try to test OSE 3.3 and see what happens as Bazsil suggested and let you know how it turns out.<br>
<br>Gergely - A 4 second difference seems HUGE to me. I haven't looked at your test program yet, but certainly will and give it a shot too, if I can.<br><br>Thanks for the help. I really appreciate it. <br><br><div class="gmail_quote">
On Mon, May 23, 2011 at 12:04 PM, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu">algernon@balabit.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">>> We recently upgraded to Solaris 10 from Solaris 9 and I don't recall<br>
>> us dropping that<br>
>> many packets before. And we also upgraded from a very older Sylog-ng<br>
>> version to 3.1.2.<br>
>> I am basing the dropped packets on the udp stats, not syslog-ng stats.<br>
>> Syslog-ng stats has NO dropped packets.<br>
><br>
> In another thread someone was complaining similar issues on Solaris. It<br>
> seems that the way syslog-ng writes log files (each line an individual<br>
> write system call), seems to have an enormous overhead on Solaris, much<br>
> more than on Linux.<br>
<br>
</div>Attached is a program that tries to measure the speed difference between<br>
write() and writev(). It first writes N messages using write(), one by<br>
one, then it writes the same N messages using writev(), IOV_MAX message<br>
at a time.<br>
<br>
On both Linux and Solaris (OpenIndiana, actually, but shouldn't be much<br>
different on real Solaris), I get similar results: about 4 seconds for<br>
the write()s to finish, and below 1 second for writev().<br>
<br>
While the write()->writev() performance is noticable, the difference<br>
between Solaris and Linux seems to be so very tiny, that it is pretty<br>
much negligible.<br>
<br>
(Unless, of course, I screwed up the test program, which is entirely<br>
possible)<br>
<font color="#888888"><br>
--<br>
|8]<br>
<br>
</font><br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
<br></blockquote></div><br>