[rsyslog] Syslog logging taking too much disk write?

Scott Baker bakers at web-ster.com
Thu Dec 20 18:04:33 CET 2007

I have a semi busy syslog server which logs about 40 or 50 lines per
second. I noticed using dstat that it's taking a TON of disk write.
In the megaBYTES per second range. This seems extremely high to me
so I wrote a script to test it.


First download dstat, gkrellm, or iostat and look at what your
normal disk write is per second. On my underused desktop it hovers
around zero or maybe 25KB/s per second.

If I run my script and tell it to log 10 lines to syslog per second

perl log_lines.pl 10

the write usage spikes up to ~160KB/s. We're only writing about 740
bytes of data per second so why is the disk write so high?

If I tell my script to instead log to a local file in /tmp at 10
lines per second

perl log_lines.pl 10 -t

The write usage spikes to ~120KB/s about once every 5 seconds (as
the buffer fills up). I'm curious why syslog writing is so much more
intense? It seems to me on a really busy syslog server that you
could seriously smoke your HDs with all the writing it's doing. Am I
missing something?

Scott Baker - Canby Telcom
RHCE - System Administrator - 503.266.8253

More information about the rsyslog mailing list