On Tue, Oct 22, 2013 at 2:52 PM, David Lang <[email protected]> wrote: > On Tue, 22 Oct 2013, Aaron Wiebe wrote: > > On instances: rsyslog will top out around 2-3 cores. Run 5-10 instances >> on the same machine using different ports if possible, on modern hardware. >> > > this largely depends on your config, we've seen configs that will max out > more cores. you should be able to use approximatly one core per output plus > one or more cores for your input. so the more different things you are > doing, the more cores you will use. >
It depends very much on the config and on what you do. The more compute-intense the templates and ruleset is, the more cores we can use (so big rexexpes mean potentially more cores, even though fewer work better). The worst-case scenario is a very basic ruleset that just writes to flat files -- there we'll probably have issue consuming more than one core for the output part -- but that's because there basically is not that much concurrency. Tuning things with different rulesets, proper batch sizes and the like also helps a lot. As David said, we have identified a new bottleneck, that is compute-intense or long-running actions that could be load-balanced using different instances connecting to the same destination. As an extreme example: you could run these 10 different processes listining on 10 diffrent ports in v7.5 with a 10-thread input, each bound to a different ruleset with each own ruleset queue. The end result is the same as using 10 different processes (so you may ask which is better -- I'd say "it depends", 10 diffrent processes also have some [robustness] charm ;)). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
