Hello, openldap writes its logs using syslog(3). Three log messages are emitted for each ldap search operation.
On a given openldap setup, I reach about 2500 operations per second. The simple fact of shutting rsyslog down icreases this number up to 5000 (logs are lost obviously). Writing to a local file, to /dev/null, or to a remote server over UDP doesn't significantly change this number. I tried tweaking various settings related to the main queue but didn't see any huge difference. ipmstats shows exactly the same numbers for "imuxsock: submitted" than for "main Q: enqueued". All the discarded/full/failed/etc counters have a value of 0. This is rsyslog-8.6.0-2.el6.x86_64 from the adiscon RPM repo (but had similar problems with version 5.8.10-9.el6_6 which comes with el6). Here's the relevant bits of my config: module(load="impstats" log.syslog="off" log.file="/var/log/impstats.log" resetCounters="off" interval="5") module(load="imuxsock" SysSock.RateLimit.Interval="0" SysSock.Annotate="off" SysSock.FlowControl="off" SysSock.IgnoreTimestamp="off") $MaxMessageSize 2k $MainMsgQueueDequeueBatchSize 1024 $MainMsgQueueType LinkedList $MainMsgQueueSize 100000 $MainMsgQueueWorkerThreads 1 $RepeatedMsgReduction off $SystemLogRateLimitInterval 0 $ActionQueueType LinkedList $ActionQueueSize 100000 $ActionQueueDiscardMark 95000 $ActionQueueDiscardSeverity 0 $ActionQueueTimeoutEnqueue 0 $ActionQueueDequeueSlowdown 1000 $ActionQueueWorkerThreads 2 $ActionQueueDequeueBatchSize 128 $ActionResumeRetryCount -1 #local4.* -/var/log/ldap/ldap.log #local4.* ~ local4.* -/dev/null #local4.* @localhost So I'm wondering which one of rsyslog or /dev/log is actually the bottleneck here and what can I do about it ? Thanks ! Marc _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
