[syslog-ng] Multi-core use in threaded mode

[Per Jessen]

Martin Holste wrote:

> That explains it, then!  Thanks for the clarification.  Sounds like
> I'll have to build some sort of intricate same-host syslog router to
> multithread the UDP in the meantime, as it's getting very near to 100%
> of a single CPU at about 20k logs/sec.  I don't suppose anyone has a
> good link to an iptables-based UDP load-balancer?

Look up the iptables statistics module.  It's fairly easily set up.

This is a NAT'ing setup I use to alternate traffic between two 
servers, maybe that'll give you some ideas:

iptables -t nat -A OUTPUT -m mark --mark 20 -m statistic --mode nth --every 2 --packet 0 -j DNAT --to $fe1
iptables -t nat -A OUTPUT -m mark --mark 20 -j DNAT --to $fe2



-- 
Per Jessen, Zürich (6.2°C)