On Mon, 2010-02-15 at 17:12 +0100, Balazs Scheidler wrote:
On Fri, 2010-02-12 at 12:55 +0000, Jean F. Mousinho wrote:
Hello,
I'm doing some performance tests between syslog-ng and rs####g (yes I guess I'm not the first to think/do something like this).
I've noticed that syslog-ng is much slower in the case of a single UDP source and destination to file due to the nature of the message reception code.
By performance you mean that incoming udp messages are dropped? Does "netstat -ns" show the udp receive error count increasing?
Yes, I'm actually using that parameter to compare the syslog daemons. So for the same amount of send syslog packets with aproximate idle interval between them, syslog-ng takes longer to receive and process them so packets are lost. Although I belive that in the case of multisource reception syslog-ng might be faster again, due to the nature of the reception code..
if that's what you mean under performance problems, then the root cause might be the latency it takes syslog-ng to go back to the udp socket after writing a chunk of data to a destination file.
OK. The project I'm working its specially important to have good 514 UDP and TCP reception performance, so thats why I focus the performance tests on those.
I plan to do that in the nearfuture though.
Its good to know that in advance :-) I personally prefer the syslog-ng configuration structure, and the code looks more organized (its just my opinion). But I need to get some conclusions (with numbers) on the best solution for the probject.. lets see how it goes, going to test the UDP+TCP performance next... Thanks for your time. Jean Mousinho