| Main Archive Page > Month Archives > syslog-ng-users archives |
[syslog-ng] delay in forwarding logs
From: Ivanov, Konstantin <cybergod_at_nospam>Date: Wed Feb 29 2012 - 21:25:58 GMT
To: syslog-ng@lists.balabit.hu
I have two servers running syslog-ng 2.0.9 on Dell R710's. I did some
benchmarking with loggen [1] and was able to generate 41000 msg/sec
locally. When I try to forward log messages from one server to the other I
only get about 60 msg/sec. tcpdump shows that only that many are sent over
the wire as well. I test this by writing to the log file from a script. Any
idea what can be the problem? Here are both configs from the sending and
receiving servers:
----------- Sending syslog-ng server --------------
options {
log_fifo_size(120000);
time_reopen (1);
time_reap(1);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (yes);
group(adm);
perm(0640);
dir_perm(0755);
keep_hostname (yes);
log_fetch_limit(60000);
};
source s_zxtm {
file("/var/log/zxtm/access_log",follow_freq(1), flags(no-parse));
};
destination d_logrelay { tcp(somehost.com port(514)); };
log {
source(s_zxtm);
destination(d_logrelay);
flags(flow-control);
};
--------------- Receiving syslog-ng server ------------------
options {
log_fifo_size(3000000);
time_reopen (1);
time_reap(1);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (yes);
group(adm);
perm(0640);
dir_perm(0755);
keep_hostname (yes);
stats_freq(600);
sync(0);
};
source s_zxtm {
tcp(max-connections(500), port(514));
};
destination d_zxtm {
file("/var/log/zxtm/incoming/$YEAR$MONTH$DAY$HOUR-access_log.aggregated"
owner("glassfish") perm(0644) template("$MESSAGE\n") template_escape(no));
};
log {
source(s_zxtm);
destination(d_zxtm);
flags(flow-control);
};
--------------
[1]. loggen -iS -r 10000000 -s 200 -I 60 localhost 514 average rate =
41053.50 msg/sec, count=410535
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq