At 3:54 PM -0500 1/29/02, Marcus J. Ranum wrote: > >As you say, >>there's way too much in a busy server's access log. > >I'm kind of curious about this: does anyone have any numbers they'd >care to share about logging rates and server log rates? How many >entries/second does a busy server's access log collect? Our mail servers are busiest...they can generate up to 50MB. Looks like they are currently logging somewhere between 350-450k entries per 30 minutes. These are qmail logs so there are several entries for each transaction. Currently I would guess these boxes are logging over 4-5 million log entries per day - as average delivery rate is at about 1.4 million per box. >I assume >they are stdio buffered so they come in approximately BUFSIZ chunks, >so it's probably pretty efficient, no? Does anyone have any numbers >for when syslogd begins to puke? Since it's using unix domain UDP >(in general) my guess is that the failure mode would be UDP packets >getting dropped on the output queue: which is system dependent. BSD >systems will do it differently from STREAMs systems which will >do it differently from Linux systems, etc, etc. > >I guess I've heard a lot of people talk about syslog bogging down under >load but I've never seen any measures behind the claim; can anyone >provide some hard information? I don't feel like writing a syslogd torture >test - has anyone? Are we operating on hearsay? On a typical mail server here syslogd is always in the top 5 for cpu usage - out of 800 processes or more usually. I haven't seen it start dropping large amounts of data - but then again I'm not looking that closely right now. thx scott -- -------------------------------------------------------------- Topica - http://www.topica.com/ Scott Nelson - drenalinat_private Director of Operations -------------------------------------------------------------- --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Tue Jan 29 2002 - 21:50:01 PST