Thanks Gergely and Bazsi!! My problem is that I don't have a test lab. Everything I try is in production. I finally am getting a lab set up but we are looking at several weeks out. I will try to test OSE 3.3 and see what happens as Bazsil suggested and let you know how it turns out. Gergely - A 4 second difference seems HUGE to me. I haven't looked at your test program yet, but certainly will and give it a shot too, if I can. Thanks for the help. I really appreciate it. On Mon, May 23, 2011 at 12:04 PM, Gergely Nagy <algernon@balabit.hu> wrote:
We recently upgraded to Solaris 10 from Solaris 9 and I don't recall us dropping that many packets before. And we also upgraded from a very older Sylog-ng version to 3.1.2. I am basing the dropped packets on the udp stats, not syslog-ng stats. Syslog-ng stats has NO dropped packets.
In another thread someone was complaining similar issues on Solaris. It seems that the way syslog-ng writes log files (each line an individual write system call), seems to have an enormous overhead on Solaris, much more than on Linux.
Attached is a program that tries to measure the speed difference between write() and writev(). It first writes N messages using write(), one by one, then it writes the same N messages using writev(), IOV_MAX message at a time.
On both Linux and Solaris (OpenIndiana, actually, but shouldn't be much different on real Solaris), I get similar results: about 4 seconds for the write()s to finish, and below 1 second for writev().
While the write()->writev() performance is noticable, the difference between Solaris and Linux seems to be so very tiny, that it is pretty much negligible.
(Unless, of course, I screwed up the test program, which is entirely possible)
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html