Logging to syslog

[Ivan Fabris]

Hi,

I set up some dns logging to syslog ( rsyslog actually ), which forwards
local1.* and local2.* to a remote rsyslog

....
  channel csyslog_d {
    syslog local1;
    severity debug 3 ;
    print-time yes;
    print-category yes;
    print-severity yes;
  };
  channel rpz_d {
    syslog local2;
    severity debug 3 ;
    print-time yes;
    print-category yes;
    print-severity yes;
  };
  category queries{
    #simple_log;
    csyslog_d;
  };
  category security{
    #simple_log;
     csyslog_d;
  };
  category rpz{
    csyslog_rpz;
  };
.....


Both syslog, and journalctl, have all the rate limits set to infinite ( all
that I could find )

...
$MUXSockRateLimitInterval 0
$MUXSockRateLimitBurst 0
$imuxsockRatelimitInterval 0
$imuxsocklRatelimitBurst 0
$imjournalRatelimitInterval 0
$imjournalRatelimitBurst 0
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
....

Did anyone find some slow down under heavy load with such a config, due to
syslog ? e.g, no slow downs with file logging
Or when the local o remote syslog are not available ( I configured the
local rsyslog with a disk cache )

I benchmarked and simulated a bit and everything runs smoothly inside the
lab
Some hint or advice ?

TIA

Ivan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20161206/78397bad/attachment.html>