Russ Allbery <[EMAIL PROTECTED]> writes:
> To be fair, some of this is caused by the fact that qmail is
> considerably more verbose in its logging than what syslog really expects
> (and what programs like sendmail do).
But, to follow up to myself and give some more firm numbers, here's an
example of just how more resource-intensive syslog is than multilog (even
with multilog appending timestamps). This is on a Solaris 2.6 machine
whose sole and exclusive purpose in life is to bounce mail; mail sent to
invalid addresses goes to this machine, which does a final LDAP lookup
just in case the main mail routers had a hiccup and then does a fuzzy LDAP
query to find possible approxmiate matches, then sends a bounce containing
that information to the envelope sender.
For each incoming message, therefore, a message is sent back out, so the
qmail logs are pretty heavy. Additionally, the bounce script logs a
single line to syslog ("unknown user <username>") and then sometimes a
single additional line for unusual circumstances. It uses syslog since
it's invoked separately for every incoming message and therefore can't
easily use multilog.
That's all that syslog is logging on this host.
syslog and multilog have been running for about the same length of time on
the system (syslog has been running for about 30 hours and multilog for
about 25 hours):
PID USERNAME THR PRI NICE SIZE RES STATE TIME CPU COMMAND
53 root 10 33 0 2636K 1200K sleep 2:08 0.05% syslogd
5444 qmaill 1 34 0 808K 528K sleep 0:52 0.04% multilog
So syslogd has spawned 10 separate threads, is more than twice as large in
its memory impact, and has used more than double the amount of system CPU
time to handle about one-tenth of the log volume of multilog.
--
Russ Allbery ([EMAIL PROTECTED]) <URL:http://www.eyrie.org/~eagle/>
