On Sun, Jan 24, 2010 at 11:37:12PM +0100, Alexander Staubo wrote:
> On Sat, Jan 23, 2010 at 12:59 PM, Willy Tarreau <[email protected]> wrote:
> > it may happen depending on the load, your syslog daemon and its config.
> > The syslog daemon from the sysklogd package is generally OK up to 1000
> > logs per second on recent, and will start dropping some of them above.
> > However, it is important to note that this syslogd does synchronous
> > logging by default, which reduces its potential to only a few tens of
> > logs per second. You have to prepend a "-" sign in front of the log
> > file names to disable this feature, like this :
> >
> > local0.* -/var/log/haproxy.log
>
> Ah, our logging was set to be synchronous. That's what happens when
> you outsource your server management. Thanks!
unfortunately that's very common :-(
> > With a properly tuned syslog-ng server, you can generally log
> > 10-20000 logs per second without any loss.
>
> What tuning options are available for syslog-ng that I should consider?
I get very good results with the following config, so feel free to
pick any parts of it or to take it as a whole.
Regards,
Willy
------
options {
sync (0);
time_reopen (10);
log_fifo_size (10000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};
source s_udp {
udp(ip(127.0.0.1) port(514));
};
destination d_haproxy { file("/var/log/haproxy"); };
filter f_local0 { facility(local0); };
filter f_local1 { facility(local1); };
filter f_local2 { facility(local2); };
log { source(s_udp); filter(f_local0); destination(d_haproxy); };
log { source(s_udp); filter(f_local1); destination(d_haproxy); };
log { source(s_udp); filter(f_local2); destination(d_haproxy); };
------
