On Tue, Oct 20, 2009 at 11:12 PM, <[email protected]> wrote: > hmm, how large are the log entries? I'm wondering if the fact that every > log entry then updates the metadata (size, time modified, etc) could > account for most, if not all, of your extra traffic. >
Most log entries are small (under 2k) but there is one log destination which produces very large log entries. We have had to increase the max message size to 64k to accommodate these messages. This is only one destination but comes from multiple sources (collated into a single file) - so with a better understanding of how the "$ActionFileEnableSync" option vs. using "-" on a particular action works, I may be able to enable sync for log destinations other than that one high volume, large message size destination. > the other thing that you could be seeing is if the NFS server records > write traffic based on # of blocks written * block size. > > when doing a sync after each write you will do a lot of blocks (but > re-write the same block many times), if it counts each of these writes as > full block that would greatly magnify the write totals. > > I think you will really like the message batching in v5. you configure it > to output every X messages or Y ms, whichever comes first. doing a sync > after every write will have _far_ less effect. > > I probably will enjoy v5 but am not yet ready to run it in production. I need to find a good balance between log update frequency and keeping NAS performance sane. I did pass this feedback along to our storage guys to see if there is any tuning we can do around this. I will also be gathering a debug log soon - awaiting approvals to run the test. I assume the debug output would show some indication of where this might be causing problems? Thanks again for the feedback. I'm pushing for a support contract as I get the feeling it'll come in handy as well and I want to support the project, but I appreciate the feedback in this forum, I know everyone is hard at work. Thanks, Aaron _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
