I have two servers running syslog-ng 2.0.9 on Dell R710's. I did some benchmarking with loggen [1] and was able to generate 41000 msg/sec locally. When I try to forward log messages from one server to the other I only get about 60 msg/sec. tcpdump shows that only that many are sent over the wire as well. I test this by writing to the log file from a script. Any idea what can be the problem? Here are both configs from the sending and receiving servers:<br>
<br><br>----------- Sending syslog-ng server --------------<br><br>options {<br><br> log_fifo_size(120000);<br> time_reopen (1);<br> time_reap(1);<br> long_hostnames (off);<br> use_dns (no);<br> use_fqdn (no);<br>
create_dirs (yes);<br> group(adm);<br> perm(0640);<br> dir_perm(0755);<br> keep_hostname (yes);<br> log_fetch_limit(60000);<br><br>};<br><br>source s_zxtm {<br> file("/var/log/zxtm/access_log",follow_freq(1), flags(no-parse));<br>
};<br><br>destination d_logrelay { tcp(<a href="http://somehost.com">somehost.com</a> port(514)); };<br><br>log {<br> source(s_zxtm); <br> destination(d_logrelay);<br> flags(flow-control);<br>};<br><br>
--------------- Receiving syslog-ng server ------------------<br><br>options {<br><br> log_fifo_size(3000000);<br> time_reopen (1);<br> time_reap(1);<br> long_hostnames (off);<br> use_dns (no);<br>
use_fqdn (no);<br> create_dirs (yes);<br> group(adm);<br> perm(0640);<br> dir_perm(0755);<br> keep_hostname (yes);<br> stats_freq(600);<br> sync(0);<br><br>};<br><br>
source s_zxtm {<br> tcp(max-connections(500), port(514));<br>};<br><br>destination d_zxtm { file("/var/log/zxtm/incoming/$YEAR$MONTH$DAY$HOUR-access_log.aggregated" owner("glassfish") perm(0644) template("$MESSAGE\n") template_escape(no)); };<br>
<br>log {<br> source(s_zxtm);<br> destination(d_zxtm);<br> flags(flow-control);<br>}; <br><br>--------------<br><br>
<p class="MsoPlainText">[1]. loggen -iS -r 10000000 -s 200 -I 60 localhost 514 average
rate = 41053.50 msg/sec, count=410535</p>