[syslog-ng] Fail safe test for syslog-ng

[Balazs Scheidler]

On Wed, 2008-01-16 at 16:18 +0200, dstuxo wrote:
> Thank you for your suggestions.
> 
> However, my mistake... I forgot to tell you that it is about
> an embedded board, with 4GB compact flash card for storage
> (CF2IDE adapter).
> This a development platform and no changes can be made to it
> at this time.
> 
> Anyways, there is still one missing part...
> After few more tests:
> I changed block I/O scheduler from CFQ to NOOP (more suitable in this case).
> Result:
> Why sysklog can handle the same messages very well and syslog-ng not?
> The same delay when starting to log.
> This gives me the clue that the problem is not with flushing buffers.
> 
> I am using syslog-ng-2.0.3 (subjective choice)
> 
> There is any major improvement (in term of speed) between this version and
> the last one?

syslog-ng has multiple input/output channels and the writes to disk is
also controlled by the main poll loop.

e.g. 

* when a message is received, it is added to the outgoing queue
* then when the poll() indicates that the destination file/tcp/udp
socket becomes writable, it is written to the target.

Using poll() this way can add some latencies.

strace has a parameter to display timing information related to
syscalls, can you measure how long it takes for syslog-ng to receive the
message (recvfrom() syscall) and write it out (write() syscall).

I might be able to reduce this latency somewhat, if this is indeed the
problem.

-- 
Bazsi