On Wed, 2008-01-16 at 16:18 +0200, dstuxo wrote:
Thank you for your suggestions.
However, my mistake... I forgot to tell you that it is about an embedded board, with 4GB compact flash card for storage (CF2IDE adapter). This a development platform and no changes can be made to it at this time.
Anyways, there is still one missing part... After few more tests: I changed block I/O scheduler from CFQ to NOOP (more suitable in this case). Result: Why sysklog can handle the same messages very well and syslog-ng not? The same delay when starting to log. This gives me the clue that the problem is not with flushing buffers.
I am using syslog-ng-2.0.3 (subjective choice)
There is any major improvement (in term of speed) between this version and the last one?
syslog-ng has multiple input/output channels and the writes to disk is also controlled by the main poll loop. e.g. * when a message is received, it is added to the outgoing queue * then when the poll() indicates that the destination file/tcp/udp socket becomes writable, it is written to the target. Using poll() this way can add some latencies. strace has a parameter to display timing information related to syscalls, can you measure how long it takes for syslog-ng to receive the message (recvfrom() syscall) and write it out (write() syscall). I might be able to reduce this latency somewhat, if this is indeed the problem. -- Bazsi