Re: Quick question on logging from HaProxy.

On Wed, Oct 24, 2007 at 09:43:37AM -0400, Lauro, John wrote:
> Perhaps the problem is using UDP instead of sockets. UDP is
> unreliable compared to sockets

it's not much a problem of reliability, it's a problem of performance I've been experiencing. Having syslogd spin at 80% CPU at 1000 lines/s is not acceptable.

> and is another reason it would be nice if haproxy supported it.
> If you switch to sockets I am sure you will
> find you can log much more traffic more reliably.

There are two problems to this :

• if the process is chrooted, it cannot access sockets outside its chroot, and syslogd cannot use anything about /dev/log. Obviously noone would consider chrooting haproxy into /dev :-)
• the congestion problem will simply be forwarded before the socket, which is on haproxy's side. Your application which reliably logs to a connected socket either pauses when the socket is full, or supports a log buffer. While a log buffer is desirable, it should not be an excuse for the server to read slowly.

Another very simple syslog I have adapted from busybox is able to forward 10k logs/s from UDP to UDP with less than 20% CPU on a single P4/3.2GHz. I find this a good starting point.

> I have one host that sometimes peeks in at tens of thousands of logs a
> second via syslog over a socket and never misses a beat. However, I
> cheat a little more than just using -, and have it log to /dev/shm
> (essentially a ram disk) and have a cron job that runs once a minute
> to rotate and then consolidate it...

It may depend on the write pattern, I don't know.

Regards,
Willy Received on 2007/10/24 16:56