Thus spake A Hoffman ([EMAIL PROTECTED]):
> Thanks Chris. Now that begs the question of why I should use multilog
> instead of syslog which does datestamp if you tell it to. It doesn't seem
> beneficial to add a superflous step. I apologize if this point seems
> irrelevant.
I knew syslog had it's problems- it can drop log entries under load
and has been the source of security problems in the past. But until
last week I didn't know just how bad it was.
I'm working with a large ISP to convert their mail systems away from
Sendmail over to QMail. While load testing the new mail servers under
an extreme load (single messages with +60,000 local recipients, etc.)
Qmail wasn't performing the way I thought it should.
After looking around the servers I found the problem. I wasn't running
mail servers, I was running syslog servers. Syslog was hogging well
over 50% of CPU time on average, and sometimes shot up above 75%.
As a test, I moved from syslog to multilog on one of the servers. The
improvement in system performance was unbelieveable. I haven't finished
re-running tests on the new configuration, but Qmail is performing
just as well as I thought it should, and is now running rings around
the old Sendmail servers.
In short- you can get away with logging to syslogd on low volume servers,
but if you want to get the best performance out of your server or if
you're running high-volume mail services you need to drop syslogd and
move to multilog.
Robbie
