[syslog-ng] spoof-source performance issues

Martin Holste mcholste at gmail.com
Mon Jun 28 20:21:12 CEST 2010


I'm finding that with a destination of udp("10.x.x.x", port(514)
spoof_source(yes)) about half of messages get lost when going from one
syslog-ng host to another at a high message rate (> 3k/sec).  This is
on 3.1 OSE and the hosts are on the same subnet and switch, so there
shouldn't be any network devices interfering.  Has anyone else had
this same issue?  My hunch is that it's either a performance issue
with the way the libnet (I'm using 1.1.2.1 on SuSE 10.2) API is
implemented or it's an issue within the libnet API.  Has anyone else
noticed performance problems when using spoof_source?


More information about the syslog-ng mailing list