Can syslog Performance Be Improved?

You can configure syslogd (and rsyslog at least) not to sync the log files after a log message by prepending a "-" to the log file path in the configuration file. This speeds up performance at the expense of the danger that log messages could be lost in a crash.

There are several options to improve syslog performance:

• Optimizing out calls with a macro

   int LogMask = LOG_UPTO(LOG_WARNING); #define syslog(a, ...) if ((a) & LogMask ) syslog((a), __VA_ARGS__) int main(int argc, char **argv) {          LogMask = setlogmask(LOG_UPTO(LOG_WARNING));          ... }

  An advantage of using a macro to filter syslog calls is that the entire call is reduced to a conditional jump on a global variable, very helpful if you happen tohave DEBUG calls which are translating large datasets through other functions.

• setlogmask()

  setlogmask(LOG_UPTO(LOG_LEVEL))

  setlogmask() will optimize the call by not logging to /dev/log, but the program willstill call the functions used as arguments.

• filtering with syslog.conf

   *.err                                               /var/log/messages

  "check out the man page for syslog.conf for details."

• configure syslog to do asynchronous or buffered logging

  metalog used to buffer log output and flushed it in blocks. stock syslog and syslog-ngdo not do this as far as I know.

Before embarking in new daemon writing you can check if syslog-ng is faster (or can be configured to be faster) than plain old syslog.