[syslog-ng] syslog CPU usage is sawtooth

[Evan Rempel]

We were running syslog-ng with default setting for time_sleep (which is 0)
and were consuming approx 50% of a single CPU with syslog-ng. We were concerned about
scalability because syslog-ng is single threaded, so we started tuning with time_sleep.
We set it to 5 and adjusted related parameters (log_fetch_limit(250), log_fifo_size(1000000))
and now we are seeing a sawtooth CPU usage with a small IO wait (2%) constant on top of the
"user" cpu sawtooth.

Tooth	cpu	duration

1	1-10%	25 minutes
2	2-10%	10 minutes
3	3-10%	10 minutes
4	4-10%	10 minutes

This pattern repeats.


Any ideas on why the sawtooth pattern started appearing only after we adjusted these settings?

Just for the curious

Redhad 3 - build from source.