hardware requirements per hits

Matus UHLAR - fantomas uhlar at fantomas.sk
Wed Aug 19 12:32:11 UTC 2009


> > On 8/17/09 10:15 PM, Fajar A. Nugraha wrote:
> >> Here are some pointers from my experience though:
> >> - syslog query logging is expensive. NEVER enable it. If you need to
> >> log client queries, log it directly to file instead.

> On Wed, Aug 19, 2009 at 12:47 AM, Subhan Malick<malicks at illinois.edu> wrote:
> > I would like to hear more about why this is so. We are currently debating
> > sending query logs to a remote syslog server to enhance some security tools.

On 19.08.09 16:11, Fajar A. Nugraha wrote:
> It depends on your requirement.
> In my case, sending query log to syslog makes disk I/O the bottleneck.
> Not really sure why logging to file directly fix this issue, perhaps
> syslog does a sync() for every line or something.

yes, unless you configure it not to do so. See man page of your syslog
version.

There's also some overhead when sending log line to another process either
via network or local socket and parsing that line in the another process.

Logging to file is just faster and more reliable unless you use remote
logging features of syslog.

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"One World. One Web. One Program." - Microsoft promotional advertisement
"Ein Volk, ein Reich, ein Fuhrer!" - Adolf Hitler



More information about the bind-users mailing list