[syslog-ng] UDP source performance improvement sugestions

[Jean F. Mousinho]

Hello,

I'm doing some performance tests between syslog-ng and rs####g (yes I
guess I'm not the first to think/do something like this).

I've noticed that syslog-ng is much slower in the case of a single UDP
source and destination to file due to the nature of the message
reception code.

I then decided to play a bit with the buffering parameters that
syslog-ng allows me to set to try improve its performance in this
specific test.

I expect that when I set time_sleep to 0, it even avoids calling
nanosleep from what I saw, so it should continuously read from the UDP
socket. I then set a big log_fifo_size 10000 (without knowing exactly if
its useful or not in this case, destination is file) and on the source
udp I set log_fetch_limit also something like 5000, log_iw_size to
10000.

These steps didn't improved the performance that much, maybe I could be
doing something wrong..

>From what I understood, this will make syslog-ng read 5000 messages from
the socket (if they are available) and only after that it queues them to
the fifo? fifo waits for flush_lines number of lines or flush_timeout to
write the data to the file?

Is there anything else that you know I could do to improve?
flush_lines > 0? .. or maybe some resource/doc I could/should read.

Thanks for your time.

Jean Mousinho