<div dir="ltr"><div><div><div>Hi,<br><br></div>You should take a look at <a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.8-guides/en/syslog-ng-ose-v3.8-guide-admin/html-single/index.html#chapter-multithreading">https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.8-guides/en/syslog-ng-ose-v3.8-guide-admin/html-single/index.html#chapter-multithreading</a> which has some performance tuning tips. And while it's for syslog-ng PE and quite old, this performance guideline also useful: <a href="https://www.balabit.com/documents/pdf/syslog-ng-pe-v5.0-performance-whitepaper-en.pdf">https://www.balabit.com/documents/pdf/syslog-ng-pe-v5.0-performance-whitepaper-en.pdf</a><br></div></div><br>Bye,<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature">Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>Balabit / syslog-ng upstream<br><a href="http://czanik.blogs.balabit.com/" target="_blank">http://czanik.blogs.balabit.com/</a><br><a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div></div>
<br><div class="gmail_quote">On Tue, Sep 27, 2016 at 10:41 PM, Clayton Dukes <span dir="ltr"><<a href="mailto:cdukes@logzilla.net" target="_blank">cdukes@logzilla.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" link="#0563C1" vlink="#954F72" lang="EN-US">
<div>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt">I have searched high and low for actual configs on how to do this, but can't nail down anything solid.</span><u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt">Does anyone have a good document or site I can reference which outlines all the details of getting syslog-ng to receive at 100k eps?</span><u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt">Including things like what is needed to add/change in sysctl.conf, etc.</span><u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt">I've found pages, like a blog entry by Etsy claiming it, but they left out the details on how to actually do it unfortunately.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:5.65pt"><span style="font-size:8.5pt;color:black"><img src="cid:image001.png@01D218DE.0E88D320" width="200" height="55"></span><span style="font-size:8.5pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:5.65pt"><b><span style="font-size:5.5pt;font-family:Helvetica;color:darkgray">Clayton Dukes</span></b><span style="font-size:5.5pt;color:darkgray"> </span><span style="font-size:5.5pt;font-family:Helvetica;color:darkgray">/</span><span style="font-size:9.0pt;color:black"> </span><span style="font-size:9.0pt;font-family:"Times New Roman";color:black">Founder
and CTO<br>
<a href="tel:%28818%29%20869-4552" value="+18188694552" target="_blank">(818) 869-4552</a>/ <a href="mailto:cdukes@logzilla.net" target="_blank"><span style="color:#e5b000">cdukes@logzilla.net</span></a><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:5.65pt"><b><span style="font-size:5.5pt;font-family:Helvetica;color:darkgray">LogZilla Corporation</span></b><span style="font-size:5.5pt;color:#ababab"> </span><span style="font-size:5.5pt;font-family:Helvetica;color:#0079cd"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:5.5pt;font-family:Helvetica;color:#0079cd"><a href="http://www.logzilla.net/" target="_blank"><span style="color:blue">http://www.logzilla.net</span></a></span><u></u><u></u></p>
</div>
</div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>