[syslog-ng] Syslog-ng performance (CPU)

[Rory]

I'm using syslog-ng as a receiver to relay messages to local processes
and other remote syslog listeners.  I'm not currently using any local
file destinations.  The issue I'm having is that as soon as I start
receiving more than a few hundred messages per second (udp) syslog-ng
uses significant CPU resources, even on an intel core-duo.

At 1000 messages per second with an average message size < 300 bytes
syslog-ng consumes 9-12% CPU.  With an event rate closer to 4000
messages per second the CPU use is 35-30%.  This seems excessive given
that I'm doing no filtering at all.  In a test configuration, I am only
receiving (no log{} clauses at all) and this behaviour is still
demonstrated.  It seems that all the CPU use is related to incoming
packet processing.  The test system is Linux 2.6.20 (Ubuntu) running on
a Core2 dual 2.16GHz.

Once I have completed some profiling I will share the findings but in
the meantime: am I missing something that should be obvious?  Some
searching through the mailing list archives hasn't helped me much.  My
test configuration file:

options {
    time_reopen(10);
    chain_hostnames(yes);
    keep_hostname(no);
    log_fifo_size(65535);
    gc_idle_threshold(100);
    gc_busy_threshold(65535);
    use_dns(no);
 };

 source remote_sources {
    udp(ip(0.0.0.0) port(514));
 };

 destination event_collector {
    tcp("127.0.0.1" port(1028));
 };

# log {
#    source(remote_sources);
#    destination(event_collector);
# };

Thanks,
Rory