[syslog-ng] UDP source performance improvement sugestions

[Jean F. Mousinho]

On Mon, 2010-02-15 at 17:12 +0100, Balazs Scheidler wrote:
> On Fri, 2010-02-12 at 12:55 +0000, Jean F. Mousinho wrote:
> > Hello,
> > 
> > I'm doing some performance tests between syslog-ng and rs####g (yes I
> > guess I'm not the first to think/do something like this).
> > 
> > I've noticed that syslog-ng is much slower in the case of a single UDP
> > source and destination to file due to the nature of the message
> > reception code.
> > 

> By performance you mean that incoming udp messages are dropped? Does
> "netstat -ns" show the udp receive error count increasing?

Yes, I'm actually using that parameter to compare the syslog daemons. So
for the same amount of send syslog packets with aproximate idle interval
between them, syslog-ng takes longer to receive and process them so
packets are lost.

Although I belive that in the case of multisource reception syslog-ng
might be faster again, due to the nature of the reception code..

> 
> if that's what you mean under performance problems, then the root cause
> might be the latency it takes syslog-ng to go back to the udp socket
> after writing a chunk of data to a destination file.

OK.

The project I'm working its specially important to have good 514 UDP and
TCP reception performance, so thats why I focus the performance tests on
those.

> I plan to do that in the nearfuture though.

Its good to know that in advance :-)

I personally prefer the syslog-ng configuration structure, and the code
looks more organized (its just my opinion). But I need to get some
conclusions (with numbers) on the best solution for the probject.. lets
see how it goes, going to test the UDP+TCP performance next...

Thanks for your time.

Jean Mousinho