[rsyslog-notify] Forum Thread: Re: Syslog Sizing - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26561#p26561

Message: 
----------
2000 events/sec is not going to strain rsyslog on even a modest box if you
have simple rules.

If you have a very complex ruleset, it could be a strain. Are you going to
compress the log archives (if so, are you going to have rsyslog do the
compression or an external program, I have one box that will use from 1 to
36 cores for just the compression, depending on the setting I use)

The biggest problem is probably going to be your database and what it takes
to accept messages at that rate (you don't say what database so it's no
even possible to begin to guess)

I'd size for the database and then add 2-4 cores and a few G of ram for
rsyslog, plus whatever compression/reporting/etc/ will need.