[syslog-ng] syslog-ng 2.0.4 How can syslog-ng achieve thisperformance???

[Geller, Sandor (IT)]

> Hi All,
> 
> NEED HELP!!!!!

Don't panic :)

> [Environment]
> SunOS 5.9 Generic_122300-07 sun4u sparc SUNW
> syslog-ng 2.0.4
> disk : single disk (no RAID)
> syslog-ng conf (global option part)
>           sync (3000);
>           time_reopen (10); 
>           time_sleep(0);
>           log_fifo_size (10000);
>           long_hostnames (off);
>           use_dns (no);
>           use_fqdn (no);
>           create_dirs (no);
>           keep_hostname (yes);
> 
> [NEED]
> I want syslog-ng to write logs to local disk at pace of about 4000
> lines per second without any lines losing.
> However, lines were in fact lost in the local file.

It would be good to see the statistics of syslog-ng. You should
set the stats_freq() option as well, and analyse the output. I
would like to recommend using stats_freq(60);

As you have omitted your log sources I don't know whether you are
logging messages originating from the network. If you did, you
should check the receive buffer options.

Also please note that using time_sleep(0) might cause performance
drops, so you should try using time_sleep(10) or higher, the optimal
setting depends on your environment...

> I am trying to know the syslog-ng max performable point. 

Depends on the speed of the CPU, the disks, your syslog-ng filters,
the ordering of the filters, ...

> [Consideration]
> "log_fifo_size" in global option is set as 10000.
> I tried to set sync() parameter, for instance 3000, in global 
> option section.
> This did not succeed with this messages when reloading the process, 
> " The value of flush_lines must be less than fifo_size; 
> fifo_size='1000',
> flush_lines='3000' ".

Looks like line #502 of logwriter.c might be the cause of this.
Seems that the global log_fifo_size isn't propagated correctly.

However you can override that by using the log_fifo_size() option
in your destination definition too.

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.