[syslog-ng] syslog-ng 2.0.4 How can syslog-ng achieve thisperformance???

Geller, Sandor (IT) Sandor.Geller at morganstanley.com
Wed Jun 20 09:03:20 CEST 2007

> Hi All,
> NEED HELP!!!!!

Don't panic :)

> [Environment]
> SunOS 5.9 Generic_122300-07 sun4u sparc SUNW
> syslog-ng 2.0.4
> disk : single disk (no RAID)
> syslog-ng conf (global option part)
>           sync (3000);
>           time_reopen (10); 
>           time_sleep(0);
>           log_fifo_size (10000);
>           long_hostnames (off);
>           use_dns (no);
>           use_fqdn (no);
>           create_dirs (no);
>           keep_hostname (yes);
> [NEED]
> I want syslog-ng to write logs to local disk at pace of about 4000
> lines per second without any lines losing.
> However, lines were in fact lost in the local file.

It would be good to see the statistics of syslog-ng. You should
set the stats_freq() option as well, and analyse the output. I
would like to recommend using stats_freq(60);

As you have omitted your log sources I don't know whether you are
logging messages originating from the network. If you did, you
should check the receive buffer options.

Also please note that using time_sleep(0) might cause performance
drops, so you should try using time_sleep(10) or higher, the optimal
setting depends on your environment...

> I am trying to know the syslog-ng max performable point. 

Depends on the speed of the CPU, the disks, your syslog-ng filters,
the ordering of the filters, ...

> [Consideration]
> "log_fifo_size" in global option is set as 10000.
> I tried to set sync() parameter, for instance 3000, in global 
> option section.
> This did not succeed with this messages when reloading the process, 
> " The value of flush_lines must be less than fifo_size; 
> fifo_size='1000',
> flush_lines='3000' ".

Looks like line #502 of logwriter.c might be the cause of this.
Seems that the global log_fifo_size isn't propagated correctly.

However you can override that by using the log_fifo_size() option
in your destination definition too.



NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

More information about the syslog-ng mailing list