[syslog-ng] Version 3.0.5 high system cpu time

[Evan Rempel]

We have been running a syslog-ng 2.0.x syslog server for
a long time now, collecting messages from a few hundred systems.
We have been very happy that the CPU for that process was running at less than 5%.

We are getting a version 3.0.5 system ready for deployment, and as a test,
have configured our 2.0.x system to copy all of its logs to the 3.0.5 server.
We have basically used the same configuration file from out 2.0.x server with
minimal changes to make it a "@version: 3.0" config file.


What I see as the major differences in this setup are:

1. New server is 64 bit Redhat 5 linux and old was 32bit Redhat 4.

2. The new servers sees one TCP connection with the full syslog stream where
    the old server has approx 300 TCP connections with only a few messages on
    each stream.


Now for the bad stuff.

On the Syslog-ng 3.0.5 system the process causes 85% CPU load (during light load periods)
and most (80% of the 85%) of that is system time, not user time.


Has anyone seen this type of behavior?

Can anyone give me some pointers to where this issue might be?


I have a few ideas, but I didn't want to "lead the witness" :-)

Thanks for your time.

Evan.