Hi!
Sorry about slightly offtopic question, but I'm curious: how much log do
you guys typically generate when it starts to act as a bottleneck?
I have systemd-journald that receives the log and propagates it via
imjournal to rsyslog which dumps it on disk and forwards it to one
central logging server using the udp syslog protocol and to another
using the tcp-plain syslog protocol and I've experienced no logging
related performance issues (although I had to tune the rate limit
settings of both systemd-journald and rsyslogd's imjournal module so
that they wouldn't start discarding log; I actually had some trouble
with that because the ratelimitburst option in rsyslog is an unsigned
short but that isn't documented anywhare and rsyslog doesn't complain if
you set it higher than fits into the data type). Typical loads here are
something like 500 slapd log lines per second, peaks something like 5000
slapd log lines per second at slapd's default logging settings. Block
devices are local (we also have some vmware nodes with vmware virtual
devices, the vmware system's data storage is on a SAN) The OS is RHEL7.
The highest %CPU I see on the two logging processes is around 20,
typically in the low single digits.
Best,
Janne Peltonen
IT Dept
University of Helsinki