My concern was just to rule out it wasn't happening once per message. On Sat, Oct 16, 2010 at 12:02 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Fri, 2010-10-15 at 16:07 -0500, Martin Holste wrote:
Actually, I missed what you were doing with awk because I don't think I've ever seen /inet before. Are you on FreeBSD? My experience (and cited performance numbers) is all on Linux. My suspicion is that nc would take into account more things like SO_RCVBUF, so I'd be interested to see if there's any difference between redirecting the raw socket and running netcat.
Your template refers to DNS hostnames, so it's certainly possible that it's a factor, though I agree that a single hostname with caching enabled should really not be a problem.
DNS resolution happens only once when a message is received. Even if you used it 20 times in your template, DNS resolution only happens once.
-- Bazsi
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html