分类： LINUX
2008-03-03 21:54:31
This section provides tips on optimizing the performance of syslog-ng. Optimizing the performance is important for syslog-ng hosts that handle large traffic.
# 注释 ：当 syslog-ng 需要处理大量主机的日志时，性能问题就变得很重要。
# -）1、禁用 DNS 解释，或者使用本地解释（/etc/hosts 文件）
# -）2、允许流控
# -）3、不要使用 user-tty（）这类型的 destination
# -）4、不要使用正则表达式，尽量使用普通的过滤器函数，例如 hosts（）、facility（）、priority（）等。
# -）5、如果大量使用的是 UDP 协议，可以尝试调大 UDP 协议的 PDU
Disable DNS resolution, or resolve hostnames locally. See for details.
Enable flow-control for the TCP sources. See for details.
Do not use the usertty() destination
driver. Under heavy load, the users are not be able to read the messages from
the console, and it slows down syslog-ng.
Do not use regular expressions in our filters. Evaluating general regular expressions puts a high load on the CPU. Use simple filter functions and logical operators instead. See for details.
When receiving lots of messages using the UDP protocol, increase the size of the UDP receive buffer on the syslog-ng hosts. For information about sizing and modifying the UDP buffer, see .
