syslog-ng 系列连载-39 ： 处理较重的消息负荷

7.2. Handling large message load

This section provides tips on optimizing the performance of syslog-ng. Optimizing the performance is important for syslog-ng hosts that handle large traffic.

# 注释 ：当 syslog-ng 需要处理大量主机的日志时，性能问题就变得很重要。

#     -）1、禁用 DNS 解释，或者使用本地解释（/etc/hosts 文件）

#     -）2、允许流控

#     -）3、不要使用 user-tty（）这类型的 destination

#     -）4、不要使用正则表达式，尽量使用普通的过滤器函数，例如 hosts（）、facility（）、priority（）等。

#     -）5、如果大量使用的是 UDP 协议，可以尝试调大 UDP 协议的 PDU

• Disable DNS resolution, or resolve hostnames locally. See for details.

• Enable flow-control for the TCP sources. See for details.

• Do not use the usertty() destination driver. Under heavy load, the users are not be able to read the messages from the console, and it slows down syslog-ng.

• Do not use regular expressions in our filters. Evaluating general regular expressions puts a high load on the CPU. Use simple filter functions and logical operators instead. See for details.

• When receiving lots of messages using the UDP protocol, increase the size of the UDP receive buffer on the syslog-ng hosts. For information about sizing and modifying the UDP buffer, see .

---