syslog-ng to replace syslogd

[Lennert Buytenhek]

On Sun, Aug 22, 2004 at 11:36:57PM +1000, Russell Coker wrote:

> > > In most cases synchronous writes for logs just reduces performance for no
> > > benefit.
> >
> > (I didn't check whether it does this already.)  Wouldn't it be possible
> > to speed up synchronous syslogging with something like this:
> >
> > That way, if you get a burst of log messages, the first sync write
> > would write out just a single line, and all the next writes would
> > write out everything that accumulated in the buffer so far in one
> > single sync write.
> 
> Your pseudo-code didn't clearly explain your intent.

Oh.  Sorry.  The idea was that "if you're going to do a sync write anyway,
why not write out all waiting messages at the same time, instead of doing
a sync write for each and every one of them even if the queue is a hundred
messages long."


> > That way, you still get sync behaviour, but without the
> > whole-disk-roundtrip-per-log-line overhead.
> 
> Usually when there's a lot of logging the performance of the syslogd
> itself is not the issue.  The problem is that synchronous writes kill
> file system performance and interfere with the performance of other
> programs in the system.

The approach I suggested would still have it make do sync writes, but
far less of them when there is a log burst compared to the old method.

But yeah, it all comes down to "how important are your log messages to you?"


--L