Chapter 4. Performance tuning in syslog-ng

Table of Contents
Setting garbage collector parameters
Setting output queue size
Setting sync parameter

There are several settings available you can finetune the behaviour of syslog-ng. The defaults should be adequate for a single server or workstation installation, but for a central loghost receiving the logs from multiple computers it may not be enough.

Setting garbage collector parameters

Syslog-ng uses a garbage collector internally, and while the garbage collector is running it does not accept messages. This may cause problems if some non-connection oriented transport protocol is used, like unix-dgram() or udp(). There are two settings which control the garbage collection phase:

gc_idle_threshold()

With this option you can specify the idle threshold of the gc. If the number of allocated objects reach this number, and the system is idle (no message arrived within 100msec), a gc phase starts. Since the system is idle, presumably no messages will be lost if the gc is ran. Therefore this value should be low, but higher than the minimally allocated objects. The minimum number of objects allocated depends on your configuration, but you can get exact numbers by specifying the -v command line option.

gc_busy_threshold()

This threshold is used when syslog-ng is busy accepting messages (this means that within 100msec an I/O event occured), however to prevent syslog-ng eating all your memory, gc should be ran in these cases as well. Set this value high, so that your log bursts don't get interrupted by the gc.