[syslog-ng] Logs out of control

[John Hala]

Hello,

I wanted to get some guidelines on how other people are controlling their syslogs with regards to I/O performance on the database side.

I am running php-syslog-ng on a separate webserver and it takes a very long time to do a search and return the results.  Long time meaning 30 to 60 minutes or even longer as the logs grow.  I have indexed the database by message, but it did not help.  The I/O on the database server is just unmanageable.

Possibilities that I'm looking into are getting 15K hard drives, change the RAID from 5 to 3, add more memory the controller's cache.

Thanks,
John