[syslog-ng] syslog-ng consumes a lot of cpu

[C. L. Martinez]

On Tue, Jun 4, 2013 at 11:18 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
> HI all,
>
>  I have installed syslog-ng 3.3.8 under an OpenBSD with a simple configuration:
>
> @version: 3.3
>
> options {
>         log_fifo_size(30000);
>         use_dns (no);
>         use_fqdn (no);
>         keep_hostname (yes);
> };
>
>
> # Define what files to be monitored
> source s_network {
>         tcp(port(10514) flags(no-multi-line));
> };
>
>
> # Define filters
>
>
>
> # Define default destinations
> destination d_ossec_fifo {
>         pipe("/var/log/syslog.fifo");
> };
>
>
> #
> # Default log actions
> #
>
> log {
>         source(s_network);
>         log { destination(d_ossec_fifo); flags(flow-control,final); };
> };
>
> but it is consuming a lot of CPU:
>
> load averages:  1.13,  1.09,  1.08
>
>                       obsdhost 11:17:49
> 25 processes: 1 running, 23 idle, 1 on processor
> CPU states:  0.8% user,  0.0% nice,  3.5% system,  0.0% interrupt, 95.7% idle
> Memory: Real: 29M/356M act/tot Free: 2655M Cache: 297M Swap: 0K/3067M
>
>   PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
> 30813 root      64    0 1260K 4204K run       -        60:49 99.02% syslog-ng
>
> Any idea why??

Changing destination to a file instead of a pipe, all works as expected:

load averages:  0.16,  0.87,  1.25
25 processes: 24 idle, 1 on processor
CPU states:  0.0% user,  0.0% nice,  0.4% system,  0.0% interrupt, 99.6% idle
Memory: Real: 29M/363M act/tot Free: 2649M Cache: 304M Swap: 0K/3067M

  PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
11308 root       2    0 1440K 3712K sleep     kqread    0:01  0.05% syslog-ng