Monday, January 11, 2010

SYSLOG performance

During recent tests I tried to measure syslog-ng performance.
I used Linux Ubuntu with 2xPentium4 3Ghz CPU. As syslog server was installed syslog-ng with some tuning (more queues, disable DNS: chain_hostnames(0), time_reopen(10), time_reap(360), sync(20), log_fifo_size(4096), use_dns(no)). For performance measurement I used shell script which count number of lines for 10 seconds.

Load on syslog server:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
18306 root 20 0 3212 932 676 S 100 0.2 0:21.52 syslog-ng
Process syslog-ng get 100% CPU

Syslog server logging performance (in lines/sec):
root@cisco-cpoc:/var/log# ./count.sh
* Stopping system logging syslog-ng [ OK ]
238940 (23894 lines/sec)
* Starting system logging syslog-ng [ OK ]
root@cisco-cpoc:/var/log#
Syslog source sent 80000 records per second (i.e. about 56K lines per second was lost).

To compare performance, I tried to log netflows with nfsen, and had about 160K entries per second. Server load during test:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
27842 netflow 20 0 3312 1253 261 R 62 0.3 0:40.52 nfcapd
I didn't have resources to generate more netflow load :)

No comments: