No problem. I'm not sure if people are interested in this, but will throw it out there: * When the central server was down for awhile, remote syslogs spool, and then when it comes back: - syslog-ng process was running 50% CPU of total system CPU ([2] proc system) [so it seems to be cpu bound, thus the time() question] - since the log data eventually gets there, its not a big deal. * With a sync(1) on the central server, the syslog-ng process's normal usage dropped by ~40% - It still climbed up to 50% when catching up logs on remote machines. * We applied the latest sun patches at the same time of this, and that also helped a lot. (from a 112233-xx to 118558-xx). The changes on the central server also impacted the remote machines. Machines with a normal 3% syslog-ng utilization dropped to 2%. This is with up to date sun hardware, solaris, and aggregately 20-30GB of logs/day. On Fri, 11 Mar 2005 13:35:58 +0100, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Thu, 2005-03-10 at 16:13 -0600, Dave Johnson wrote:
We did some maintaince on our sol9 central syslog-ng server recently running syslog-ng v1.6.4, and noticed something...
truss -p on the syslog-ng process shows an abundant number of time() calls. The ratio of time() to read()/write()s were a factor of 20-40x.
* This is even with use_time_recv(no); in the global options.
I'm trying to understand if this is something that could be cut down some or if its a standard solaris process overhead... ?
It probably could be reduced somewhat, though currently I have no such intention myself.
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html