# Syslog performance issue



## philipz (Aug 7, 2009)

All,

I am having an issue with my syslog server running 7.2.
When I tail the file, I see no activity for 5 to 10 seconds, then I get some entries, then a pauze again and so on.
A tcpdump is showing a constant flow of messages, but it seems syslog can't catch up?
I restarted the daemon, looked at the config, tried to run in debugmode but can't see anything wrong.

Any advice?

much appreciated!


----------



## Alt (Aug 7, 2009)

I think its not a problem, its buffering effect.


----------



## philipz (Aug 7, 2009)

Not really, because the messages don't show up, not even afterwards when I parse the syslog file. They are lost; the amount of messages coming in is definitely not the same as the syslog log is showing.
I have a similar setup (running FBSD v6.2) and there it works properly so it must be version or system specific...


----------



## DutchDaemon (Aug 7, 2009)

Try disabling DNS lookups and compression of messages (-n and -cc options to syslogd(8).


----------



## philipz (Aug 7, 2009)

DutchDaemon said:
			
		

> Try disabling DNS lookups and compression of messages (-n and -cc options to syslogd(8).



That did the trick, coolio!
Many thanks!


----------



## DutchDaemon (Aug 7, 2009)

If you have a very fixed set of hosts logging to one central server, add them to that server's /etc/hosts. Looks a bit prettier.


----------

