[syslog-ng] Profiling syslog-ng

[Kevin]

On 2/10/06, John Morrissey <jwm at horde.net> wrote:
> I'm trying to profile syslog-ng on a set of servers that generate high
> levels of logging traffic (a few GB/day). Currently, syslog-ng is consuming
> anywhere from 40-80% of a CPU on a dual Pentium IV Xeon machine.

Even for the slowest possible P4, that seems immensely high.
Can you give more information about what on these servers generates
the log events, the average log message length, and the average and
peak events/second rate?

> Any suggestions on how to profile syslog-ng?
>  can post my configuration if it'd be helpful,

Please do.

> but we've twisted many knobs (gc idle/busy thresholds,
> buffering via different sync() levels, disabling remote syslogging via UDP,
> etc.) without a major change in CPU consumption.

Just as a SWAG, the first thing I'd wonder is if there's a regex
match in your configuration chewing cycles.

Kevin