<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:zbyszek@in.waw.pl" title="Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>"> <span class="fn">Zbigniew Jedrzejewski-Szmek</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - RFE: journald to send logs via network"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77013">bug 77013</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>REOPENED
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - RFE: journald to send logs via network"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77013#c10">Comment # 10</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - RFE: journald to send logs via network"
href="https://bugs.freedesktop.org/show_bug.cgi?id=77013">bug 77013</a>
from <span class="vcard"><a class="email" href="mailto:zbyszek@in.waw.pl" title="Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>"> <span class="fn">Zbigniew Jedrzejewski-Szmek</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=77013#c8">comment #8</a>)
<span class="quote">> Did your code get off your laptop yet?</span >
I pushed the code to systemd master today (commit
<a href="http://cgit.freedesktop.org/systemd/systemd/commit/?id=3d090cc6f34e59">http://cgit.freedesktop.org/systemd/systemd/commit/?id=3d090cc6f34e59</a> and
surrounding ones).
(In reply to <a href="show_bug.cgi?id=77013#c7">comment #7</a>)
<span class="quote">> > At my company we use journal2gelf [1] to push messages. Of course, that
> > pushes in GELF format, which is for Logstash aggregation, not journal
> > aggregation. I'd be concerned about the performance implications of push
> > aggregation to the journal right now.
> Journald is fairly slow because it does a lot of /proc trawling for each
> message. When receiving messages over the network, all possible data is
> already there, so it should be reasonably fast. I expect HTTP and especially
> TLS to be the bottlenecks, not the journal writing code. Running benchmarks
> is on my TODO list.</span >
Well, I was quite wrong here. It turns out that writing to the journal *is* the
slow part. I'll probably publish some benchmarks on the mailing list tomorrow,
but, essentially, writing to the journal is the most significant part, followed
by TLS overhead. But if compression is turned on, things are much worse,
because XZ compression was very slow. This patchset was delayed because I
worked on adding LZ4 compression to the journal, which in turned caused other
people to tweak XZ settings, improving compression speed greatly without
significant loss of compression ratio. So in general, things improved on all
fronts. With LZ4 compression, compression overhead should be less significant,
since the speed is in the 500-1500 MB/s range, depending on the compressibility
of data.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>