[syslog-ng]performance test questions

[Nate Campi]

On Thu, Jan 30, 2003 at 05:12:56PM +0100, Roberto Nibali wrote:
> 
> I'm conducting syslog-ng performance tests. I've deployed a central loghost 
> environment and three clients trying to send messages which should end up 
> on the central loghost with as few losses as possible. The whole thing is 
> currently done over UDP and the clients have either syslogd or syslog-ng as 
> daemons.

Balazs has found some problems he's looking into, but there's something
left for you to do. You need to establish a baseline for the maximum
throughput your OS and network can send over UDP. If you setup a
listener on a UDP port that simply discarded all input (instead of
syslog-ng) and send UDP packets with little or no payload, you may still
get all kinds of packet loss.

The reason for this is because it's possible to overflow your UDP send
buffer before anything is even written to the network. Your message loss
may primarily be on the sending system, and have little to do with
syslog-ng.

<URL:http://cert.uni-stuttgart.de/archive/loganalysis/2002/01/msg00049.html>

-- 
Nate Campi   http://www.campin.net 

"Computers are useless. They can only give you answers." - Picasso,
Pablo (1881-1973)