On Mon, 11 Jul 2011, V B wrote:
Gents,
I have compiled rsyslog with --enable-pthreads, and can see the threads.
20087 root 15 0 100m 4060 1704 R 37.0 0.1 0:52.24 rs:main Q:Reg
20088 root 16 0 100m 4060 1704 R 4.0 0.1 0:07.15 rs:action 2
que
20084 root 16 0 100m 4060 1704 S 1.0 0.1 0:03.75 rsyslogd
Also, what this tells me (from this graph
http://www.rsyslog.com/doc/queues_analogy.html) is that most processing
power is in the input, pre-processor, and the filter engines.
Any way we can speed this up?
Also, it seems that throwing more cores at rsyslog would not help... a 4
core machine should do just fine. 4GB ram sufficient?
the number of threads rsyslog uses depends on the configuration (more
inputs mean more threads for example), but with your configuration it
looks like more cores would not make any difference.
ram needs to be large enough to handle your queues, depending on how large
you make the queues and how you set max message size, and how much the
queues get backed up it can eat more memory.
as for asking to speed it up, if what you snipped is the output from top,
it seems to be showing that no thread in rsyslog is using more than 37%
cpu, so you are not being limited by cpu speed.
there are a number of things that can be done in the configuration to make
it take less cpu to process the log messages, but the first question is
what are you doing that is noticing a problem (also, what version are you
running, new versions are FAR faster than old versions)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
