[syslog-ng] Debugging tools for syslog-ng

[Gergely Nagy]

Anton Koldaev <koldaevav at gmail.com> writes:

> I wanted to know if syslog-ng developers has some tools like mysqltuner or
> just a shell scripts to check syslog-ng configuration and get some
> recommendations on tuning?

My bottleneck is usually not syslog-ng, so I use perf/tuning tools to
whatever is on the other end (be that a database, filesystem or
network). To see how much I need to tune the various syslog-ng buffers,
I do load testing in a simulated environment, and base my settings on
the number of dropped messages, and tune both the receiving end and
syslog-ng until the drop count gets to zero during peak-like loads.

So far, this method worked remarkably well, but most of my setups have
reasonably low incoming log volume, most time is spent post-processing
them, which I usually do outside of syslog-ng.

> For example if I'm using flow-control+multiple destinations it can stop
> reading the source at any time and I have no idea when and why it's
> happening and which value should I tune.

It would be nice if syslog-ng would log an info (so that I don't need to
enable debug logging on a live system) level message when flow-control
kicks in (and when it stops). For bonus points, if it could tell what
triggered it, and which source it applies to, that'd be great.

I don't think we can do this yet, though.

-- 
|8]