Thanks Gergely and Bazsi!!

My problem is that I don't have a test lab. Everything I try is in production. I finally am getting a lab set up but we are looking at several weeks out. I will try to test OSE 3.3 and see what happens as Bazsil suggested and let you know how it turns out.

Gergely - A 4 second difference seems HUGE to me. I haven't looked at your test program yet, but certainly will and give it a shot too, if I can.

Thanks for the help. I really appreciate it.

On Mon, May 23, 2011 at 12:04 PM, Gergely Nagy <algernon@balabit.hu> wrote:
>>  We recently upgraded to Solaris 10 from Solaris 9 and I don't recall
>> us dropping that
>> many packets before. And we also upgraded from a very older Sylog-ng
>> version to 3.1.2.
>> I am basing the dropped packets on the udp stats, not syslog-ng stats.
>> Syslog-ng stats has NO dropped packets.
>
> In another thread someone was complaining similar issues on Solaris. It
> seems that the way syslog-ng writes log files (each line an individual
> write system call), seems to have an enormous overhead on Solaris, much
> more than on Linux.

Attached is a program that tries to measure the speed difference between
write() and writev(). It first writes N messages using write(), one by
one, then it writes the same N messages using writev(), IOV_MAX message
at a time.

On both Linux and Solaris (OpenIndiana, actually, but shouldn't be much
different on real Solaris), I get similar results: about 4 seconds for
the write()s to finish, and below 1 second for writev().

While the write()->writev() performance is noticable, the difference
between Solaris and Linux seems to be so very tiny, that it is pretty
much negligible.

(Unless, of course, I screwed up the test program, which is entirely
possible)

--
|8]


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html