[tpop3d-discuss] How do i change the syslog facility?

[Paul Makepeace]

On Wed, Nov 07, 2001 at 11:42:42PM +0000, Chris Elsworth wrote:
> A busy mail server might spend almost as much time (remember ISPs turn 
> logging up to aid in troubleshooting, coping for customer complaints, etc) 
> logging as it does sending mail when going via syslogd.
> 
> A real life example. Demon use thttpd (a very lightweight httpd server)
> for Homepages. Output from top with irrelevant processes snipped:
> 
>   PID USERNAME THR PRI NICE  SIZE   RES STATE   TIME    CPU COMMAND
> 24110 nobody     1  49    0   51M   18M run   549.2H 12.94% thttpd
> 15207 root      18  58    0 4608K 1824K sleep  82.8H  1.57% syslogd

I'm curious -- is the machine that is logging the syslog messages also
the same machine that is writing data to a file somewhere? Typically a
busy system will have a dedicated syslogging facility that has its own
optimi[sz]ed resources (disk, cpu, etc). That is typically one of
the major plus points of syslog after all is its ability to
centrali[sz]e logging.

> Notice the runtime on each process. syslogd takes up a substantial amount 
> of CPU time - for this reason we're looking at moving to direct file 
> logging. One line (about 100 bytes) is logged per hit.

Have you looked at disk contention, profiled/straced syslogd and checked
for filesystem fragmentation?

I'm not saying syslog is the panacea but I've often seen it blamed where
it wasn't really the main culprit, more of a pest that spits while
others are throwing rocks.

Paul