We run syslog-ng (both 1.x and now 2.0.9) on FreeBSD writing log files to a NetApp NFS server. At a very low load we start dropping inbound packets (udp, large socket buffers). A quick tcpdump showed a pathological interaction with NFS revolving around how NFS (at least on BSD) deals with APPEND mode. The upshot is that for each write, it flushes the attributes and actually re-reads the partial file block back from the server!

A simple change to the source – to remove O_APPEND had great results – we can handle 10x the number of inbound messages.

Our .conf file has every logging host going to a separate file, and with a quick scan of the code it sure looked like syslog-ng won’t open the same file more than once anyway (I could be wrong here).

So, a couple questions (I scanned the last few months of archives but didn’t see any discussion about this) - what breaks if anything by turning off APPEND, is this interesting to others/how might I get this into future releases ( I can see this being a per-destination option).

thanks.


--
It is the mark of an instructed mind to rest satisfied
with the degree of precision which the nature of a subject admits,
and not to seek exactness when only an approximation of the truth
is possible.
         Aristotle