[syslog-ng]too much time() ?

[Dave Johnson]

No problem.

I'm not sure if people are interested in this, but will throw it out there:
* When the central server was down for awhile, remote syslogs spool,
and then when it
  comes back:
  - syslog-ng process was running 50% CPU of total system CPU ([2] proc system) 
    [so it seems to be cpu bound, thus the time() question]
   - since the log data eventually gets there, its not a big deal.
* With a sync(1) on the central server, the syslog-ng process's normal
usage dropped
  by ~40%
  - It still climbed up to 50% when catching up logs on remote machines.
* We applied the latest sun patches at the same time of this, and that
also helped a lot.
   (from a 112233-xx to 118558-xx).

The changes on the central server also impacted the remote machines. 
Machines with a normal 3% syslog-ng utilization dropped to 2%.

This is with up to date sun hardware, solaris, and aggregately 20-30GB
of logs/day.

On Fri, 11 Mar 2005 13:35:58 +0100, Balazs Scheidler <bazsi@balabit.hu> wrote:
> On Thu, 2005-03-10 at 16:13 -0600, Dave Johnson wrote:
> > We did some maintaince on our sol9 central syslog-ng server
> > recently running syslog-ng v1.6.4, and noticed something...
> >
> > truss -p on the syslog-ng process shows an abundant number of time() calls.
> > The ratio of time() to read()/write()s were a factor of 20-40x.
> >
> > * This is even with use_time_recv(no); in the global options.
> >
> > I'm trying to understand if this is something that could be cut down
> > some or if its a standard solaris process overhead...  ?
> 
> It probably could be reduced somewhat, though currently I have no such
> intention myself.
> 
> --
> Bazsi
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 
>