[syslog-ng] syslog_ng and NFS

[Chris Wagner]

We run syslog-ng (both 1.x and now 2.0.9) on FreeBSD writing log files to a
NetApp NFS server. At a very low load we start dropping inbound packets
(udp, large socket buffers). A quick tcpdump showed a pathological
interaction with NFS revolving around how NFS (at least on BSD) deals with
APPEND mode. The upshot is that for each write, it flushes the attributes
and actually re-reads the partial file block back from the server!

A simple change to the source ­ to remove O_APPEND had great results ­ we
can handle 10x the number of inbound messages.

Our .conf file has every logging host going to a separate file, and with a
quick scan of the code it sure looked like syslog-ng won¹t open the same
file more than once anyway (I could be wrong here).

So, a couple questions (I scanned the last few months of archives but didn¹t
see any discussion about this) - what breaks if anything by turning off
APPEND, is this interesting to others/how might I get this into future
releases ( I can see this being a per-destination option).

thanks.


-- 
It is the mark of an instructed mind to rest satisfied
with the degree of precision which the nature of a subject admits,
and not to seek exactness when only an approximation of the truth
is possible.
         Aristotle

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080529/c8eb9286/attachment.htm