[syslog-ng]syslog-ng vs (of all things) Win2k + IIS

[Jeffrey W. Baker]

On Thu, 5 Oct 2000 matthew.copeland@honeywell.com wrote:

> 
> This afternoon I was in a debate with another one of the software
> engineering guys here were I work.  He has made the claim that for 300
> machines each logging a message at least every 10 seconds (probably more
> like once every other second.)  that encapsultaing the message in an XML
> tag and then sending that to a windblows 2000 box via HTTP running IIS,
> where it has to process the message using a CGI or ASP script, is more
> scalable than using syslog-ng, and that syslog-ng can't even handle this
> load.  Now, I would beg to differ on this assesment, but I need to find
> some numbers to backup my claim.  Can anyone help?  (Ohh.. and you don't
> have to necessarily use an Intel box for the main server)

You had better make sure that the disk on the destination is faster than
the sum of the logging rates of all the other hosts, or the syslog-ng on
the destination machine will start throwing entries away, and *then*
you'll really be embarrassed :)

A rate of 150 messages per second should be really easy for syslog-ng.  
The other "solution" will spend more time running DOM parsers than
anything else.

-jwb