Hello, I'm doing some performance tests between syslog-ng and rs####g (yes I guess I'm not the first to think/do something like this). I've noticed that syslog-ng is much slower in the case of a single UDP source and destination to file due to the nature of the message reception code. I then decided to play a bit with the buffering parameters that syslog-ng allows me to set to try improve its performance in this specific test. I expect that when I set time_sleep to 0, it even avoids calling nanosleep from what I saw, so it should continuously read from the UDP socket. I then set a big log_fifo_size 10000 (without knowing exactly if its useful or not in this case, destination is file) and on the source udp I set log_fetch_limit also something like 5000, log_iw_size to 10000. These steps didn't improved the performance that much, maybe I could be doing something wrong..
From what I understood, this will make syslog-ng read 5000 messages from the socket (if they are available) and only after that it queues them to the fifo? fifo waits for flush_lines number of lines or flush_timeout to write the data to the file?
Is there anything else that you know I could do to improve? flush_lines > 0? .. or maybe some resource/doc I could/should read. Thanks for your time. Jean Mousinho