On Thursday, November 11, 2010 08:51:11 Matthew Hall wrote:
On Thursday, November 11, 2010 08:29:32 Martin Holste wrote:
You should not be having problems with your load. We had a thread earlier this year ("UDP packet loss with syslog-ng") in which Lars identified similar performance issues on RHEL. His problems were solved by setting the net.core.rmem_default to 2MB using sysctl. I would try setting that and then checking your performance.
Make sure to also set the so_rcvbuf in syslog-ng on any high volume socket based log sources.
You need to have a really big buffer or you will get terrible performance. We've been making some efforts to get this into the documentation.
I think it's small by default so it doesn't consume a ton of RAM on boxes that are not used for log collection.
By really big I mean 16,777,216. -- Matthew Hall