Hi Mikael,
We're getting rather off topic - so lets take this off the list - OK ?
See in-line comments:
On 2002-04-28 01:36 +0200 Mikael Olsson typed:
MO>
MO>
MO>
MO>
MO> Now, I realize that a syslog daemon would need to do a bit more
MO> work than my fake one, but, as we can see, the actual "CPU
MO> crunching" isn't the problem here. (As you rightly pointed out.)
MO>
MO> Anyway, I think this nicely illustrates my original point that
MO> 100 pps, even with a crappy syslog daemon, shouldn't be a problem
MO> for any system that hasn't already passed its MTBF. Given, of
MO> course, that it doesn't attempt to flush its output files for every
MO> packet that it writes. That _is_ painful.
Quote from syslog.conf(5) man page on a RedHat system:
---
You may prefix each entry with the minus ``-'' sign to omit syncing the
file after every logging. Note that you might lose information if the
system crashes right behind a write attempt. Nevertheless this might give
you back some performance, especially if you run programs that use logging
in a very verbose manner.
---
I read that as the default being flushing after every packet ... :-(
Also under some OS's(I don't recall which) syncing a large (log)file
takes *much* longer than a small file - combine that with syncing after
every log message and "painful" would be quite an understatement ...
--
Regards,
Rafi
MO>
MO>
MO> Regards,
MO> Mikael Olsson
MO>
MO>
_______________________________________________
Firewalls mailing list
[EMAIL PROTECTED]
For Account Management (unsubscribe, get/change password, etc) Please go to:
http://lists.gnac.net/mailman/listinfo/firewalls
