[syslog-ng] syslog-ng with sqlite 100% cpu
work.greeran at gmail.com
Wed Feb 15 07:57:50 UTC 2017
thanks for the response
For now our architecture is limiting us to an old syslog-ng version so we
as for the flush we are running it with 200 and with timeout 200 also. we
are trying to increase the flush-lines to 1000 and see if it helps.
i also googled the problem and saw a couple of mails that said that there
was a bug with syslog-ng 3.2.5/4 and pcre that created a bug with the cpu
usage. does someone if it might be the problem and how to fix it.
On Tue, Feb 14, 2017 at 5:53 PM, Scheidler, Balázs <
balazs.scheidler at balabit.com> wrote:
> It might be because of transaction size. Sqlite is very inefficient if the
> transaction size is small.
> Newer syslog-ng versions support batching, set flush-lines to something
> like 100 and it would improve a lot.
> On Feb 14, 2017 06:31, "Fekete, Róbert" <robert.fekete at balabit.com> wrote:
>> It is not normal, it might be a bug. However, version 3.2 is ancient, I'd
>> recommend upgrading to a newer version. You can find release tarballs on
>> github, or links to binaries here: https://syslog-ng.org/3r
>> On Tue, Feb 14, 2017 at 3:19 PM, work ran <work.greeran at gmail.com> wrote:
>>> i am running syslog-ng with sqlite
>>> i am sending 50 logs per second and i am getting 80% cpu usage.
>>> could someone tell me how i can fix this or is it normal
>>> syslog-ng 3.2.5
>>> Installer-Version: 3.2.5
>>> Revision: ssh+git://email@example.com//var/scm/git/syslog-ng/syslog-ng
>>> Compile-Date: Jul 25 2014 15:20:50
>>> Enable-Threads: on
>>> Enable-Debug: off
>>> Enable-GProf: off
>>> Enable-Memtrace: off
>>> Enable-Sun-STREAMS: off
>>> Enable-IPv6: on
>>> Enable-Spoof-Source: on
>>> Enable-TCP-Wrapper: on
>>> Enable-SSL: off
>>> Enable-SQL: on
>>> Enable-Linux-Caps: off
>>> Enable-Pcre: on
>>> Enable-Pacct: off
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation: http://www.balabit.com/support
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng