Hi,
I am calling syslog in c++ using syslog.h . the time it takes on each call
is too long. I am comparing it with IPC Queue and there is almost 100usec
overhead when I call syslog() vs ipc.
I did some benchmarking, when I use a single process for hitting syslog the
performance is great it stays at avg 11usec/record for 1m records on my
system. but if I run 10 of these processes the time will increase to about
100usec/record.
Another problem is that memory usage remains really low ~0% so that tells
me syslog() is somehow blocking and using cpu rather than do a set an
forget to the queue and process it later on. another issue is that all
workers are not engage. I see 5 workers but only 3 are working.
The way I'm using it in prod is about 500 threads hit syslog(). I need to
keep the time it takes for a syslog() call to a constant of 10usec ideal to
max 40usec.
Also, I am not doing openlog() before calling syslog()
This is my configuration:
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/
html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by
rklogd)
#$ModLoad immark # provides --MARK-- message capability
# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
# For debug only
# module(load="impstats" interval="1" severity="8")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction off
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser root
$PrivDropToGroup root
#
# Where to place spool files
#
$WorkDirectory /var/spool/rsyslog
$ActionResumeRetryCount -1 # infinite retries if
host is down
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$MaxMessageSize 4k
main_queue(
queue.Type="LinkedList"
queue.Size="1000000"
queue.workerThreads="8"
queue.workerThreadMinimumMessages="10000"
queue.SaveOnShutdown="on"
)
template(name="localone" type="string" string="%msg:2:$%\n") # ":2:$" -->
tells rsyslog to ignore the leading char, b/c rsyslog adds a leading space
to every message
if $syslogfacility-text == 'local1' then {
action(
type="omfile"
template="localone"
file="/var/log/local1.log"
flushOnTXEnd="off"
asyncWriting="on"
ioBufferSize="64k"
queue.type="LinkedList"
queue.size="1000000"
queue.dequeueBatchSize="4096"
queue.workerThreads="8"
queue.workerThreadMinimumMessages="10000"
queue.SaveOnShutdown="on"
action.ResumeRetryCount="-1"
)
stop
}
#if $syslogtag contains 'rsyslogd-pstats' then {
# action(
# type="omfile"
# queue.type="LinkedList"
# queue.discardmark="1000"
# name="pstats"
# file="/var/log/pstats.log"
# )
# stop
#}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
