Hi!
Sorry about slightly offtopic question, but I'm curious: how much log do you guys typically generate when it starts to act as a bottleneck?
I have systemd-journald that receives the log and propagates it via imjournal to rsyslog which dumps it on disk and forwards it to one central logging server using the udp syslog protocol and to another using the tcp-plain syslog protocol and I've experienced no logging related performance issues (although I had to tune the rate limit settings of both systemd-journald and rsyslogd's imjournal module so that they wouldn't start discarding log; I actually had some trouble with that because the ratelimitburst option in rsyslog is an unsigned short but that isn't documented anywhare and rsyslog doesn't complain if you set it higher than fits into the data type). Typical loads here are something like 500 slapd log lines per second, peaks something like 5000 slapd log lines per second at slapd's default logging settings. Block devices are local (we also have some vmware nodes with vmware virtual devices, the vmware system's data storage is on a SAN) The OS is RHEL7. The highest %CPU I see on the two logging processes is around 20, typically in the low single digits.
Best,
Janne Peltonen IT Dept University of Helsinki