[rsyslog] Syslog logging taking too much disk write?

Rainer Gerhards rgerhards at hq.adiscon.com
Thu Dec 20 18:39:40 CET 2007


Could you post your rsyslog.conf please. Without seeing it, it sounds
like you sync the disc with every write. Unfortunately, this is the
legacy default. You can turn it off with placing a dash before the
selector line:

e.g. *.* /var/log/whatever

syncs after each write, while

*.* -/var/log/whatever

uses buffering - which should be fairly safe with decent hardware and a
UPS...

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Scott Baker
> Sent: Thursday, December 20, 2007 6:05 PM
> To: rsyslog at lists.adiscon.com
> Subject: [rsyslog] Syslog logging taking too much disk write?
> 
> I have a semi busy syslog server which logs about 40 or 50 lines per
> second. I noticed using dstat that it's taking a TON of disk write.
> In the megaBYTES per second range. This seems extremely high to me
> so I wrote a script to test it.
> 
> http://www.perturb.org/code/log_lines.pl
> 
> First download dstat, gkrellm, or iostat and look at what your
> normal disk write is per second. On my underused desktop it hovers
> around zero or maybe 25KB/s per second.
> 
> If I run my script and tell it to log 10 lines to syslog per second
> 
> perl log_lines.pl 10
> 
> the write usage spikes up to ~160KB/s. We're only writing about 740
> bytes of data per second so why is the disk write so high?
> 
> If I tell my script to instead log to a local file in /tmp at 10
> lines per second
> 
> perl log_lines.pl 10 -t
> 
> The write usage spikes to ~120KB/s about once every 5 seconds (as
> the buffer fills up). I'm curious why syslog writing is so much more
> intense? It seems to me on a really busy syslog server that you
> could seriously smoke your HDs with all the writing it's doing. Am I
> missing something?
> 
> --
> Scott Baker - Canby Telcom
> RHCE - System Administrator - 503.266.8253
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog



More information about the rsyslog mailing list