I tested with kiwi syslog generator and I found either syslog-ng or syslogd is putting the log into file destination very slow at fastest exactly 10sec per log. At the rest of the log is queue in buffer. If syslog-ng were to run in environment that has log input with consistently 1 log per second, this will not work even we set the buffer large. Also not real time. I believe this is something to do with the synchronisation of SOCK_STREAM socket because I am using linux. Do you know how to fine tune this. Regards
On Sun, Nov 11, 2001 at 08:32:58PM -0800, Chee Chew wrote:
I tested with kiwi syslog generator and I found either syslog-ng or syslogd is putting the log into file destination very slow at fastest exactly 10sec per log. At the rest of the log is queue in buffer. If syslog-ng were to run in environment that has log input with consistently 1 log per second, this will not work even we set the buffer large. Also not real time.
I believe this is something to do with the synchronisation of SOCK_STREAM socket because I am using linux. Do you know how to fine tune this.
we are using syslog-ng in environments where there are more than 50 messages/seconds. so you may have missed something. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
On Sun, Nov 11, 2001 at 08:32:58PM -0800, Chee Chew wrote:
I tested with kiwi syslog generator and I found either syslog-ng or syslogd is putting the log into file destination very slow at fastest exactly 10sec per log. At the rest of the log is queue in buffer. If syslog-ng were to run in environment that has log input with consistently 1 log per second, this will not work even we set the buffer large. Also not real time.
I believe this is something to do with the synchronisation of SOCK_STREAM socket because I am using linux. Do you know how to fine tune this.
This feels like a DNS issue. If you tell syslog-ng not to resolve hostnames, does the lag disappear? ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt@cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)
On Sun, Nov 11, 2001 at 08:32:58PM -0800, Chee Chew wrote:
I tested with kiwi syslog generator and I found either syslog-ng or syslogd is putting the log into file destination very slow at fastest exactly 10sec per log. At the rest of the log is queue in buffer. If syslog-ng were to run in environment that has log input with consistently 1 log per second, this will not work even we set the buffer large. Also not real time.
I believe this is something to do with the synchronisation of SOCK_STREAM socket because I am using linux. Do you know how to fine tune this.
I've captured around 2 million messages in the last 3 days on a linux loghost, so I don't think Linux is your problem. Post your config here, especially whether you're using DNS or not and we can help out. -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 Microsoft Vaccine 2000 is configuring your immune system. This may take a few minutes. If your body stops responding for a long time and there is no brain activity please die. Setup will continue after you are reborn.
participants (4)
-
Balazs Scheidler
-
Brad Arlt
-
Chee Chew
-
Nate Campi