[rsyslog-notify] Forum Thread: Re: Syslog Sizing - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26563#p26563

Message: 
----------
That doesn't really help. the performance of your database will vary
greatly between mysql and postgres and oracle and ... (and even with a
specific database the configuration can make a huge difference)

you say you are going to be compressing the logs, that can vary drastically
depending on the compression you use. xz -9e can be 100x the cpu of xz -1
for example (and this can vary depending on your data)

with a small number of rules, at only a couple thousand messages/sec you
could probably get away with a single core for rsyslog. The load comes when
you start parsing the logs, reformatting them, etc.

rsyslog is the smallest part of your problem, compression and database will
dominate (and the two typically don't play well together on the same
system)