[syslog-ng] Expected performance

[Matt Zagrabelny]

On Wed, 2009-02-18 at 16:12 -0500, Christopher Bland wrote:
> Hey guys,
> 
> I know it's hard to compare apples to apples when you start talking 
> about performance and hardware but I would appreciate some feedback.  I 
> am currently have a 32Bit HP Proliant DL380 with 2 2.8Ghz cpus and 4G of 
> memory running Fedora 10.  At present I have 150 hosts generating 
> between 10-15G worth of logs per day.  I dump all of my logs to a Mysql 
> database so that I can use php-syslog-ng.  The OS is build on a 1.2T 
> raid 5 disk array.  To  cut down on I/O I have the database writing to a 
> ext3 filesystem while the rest of the box uses LVM.  I have mounted the 
> database partition with noatime and implemented all of the mysqltuner 
> suggestions.  My box is performing slow like molasses. 

[...]

> My load looks like this while inserting data:
> 
> Tasks: 177 total,   1 running, 176 sleeping,   0 stopped,   0 zombie
> Cpu(s): 20.4%us,  2.3%sy,  0.1%ni, 75.9%id,  0.7%wa,  0.0%hi,  0.6%si,  
> 0.0%st
> Mem:   3634412k total,  3507692k used,   126720k free,    20224k buffers
> Swap:  8388600k total,       64k used,  8388536k free,  3246292k cached

It isn't good that you are swapping. Though it isn't much at this point.
Is there a memory leaky application on the box?

What is the uptime of the box?

FWIW, I generally don't consider ext3 to be a *fast* FS.

-- 
Matt Zagrabelny - mzagrabe at d.umn.edu - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090218/62c00007/attachment.pgp