[systemd-bugs] [Bug 77013] RFE: journald to send logs via network

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=77013

Zbigniew Jedrzejewski-Szmek <zbyszek at in.waw.pl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Zbigniew Jedrzejewski-Szmek <zbyszek at in.waw.pl> ---
(In reply to comment #8)
> Did your code get off your laptop yet?
I pushed the code to systemd master today (commit
http://cgit.freedesktop.org/systemd/systemd/commit/?id=3d090cc6f34e59 and
surrounding ones).

(In reply to comment #7)
> > At my company we use journal2gelf [1] to push messages. Of course, that
> > pushes in GELF format, which is for Logstash aggregation, not journal
> > aggregation. I'd be concerned about the performance implications of push
> > aggregation to the journal right now.
> Journald is fairly slow because it does a lot of /proc trawling for each
> message. When receiving messages over the network, all possible data is
> already there, so it should be reasonably fast. I expect HTTP and especially
> TLS to be the bottlenecks, not the journal writing code. Running benchmarks
> is on my TODO list.
Well, I was quite wrong here. It turns out that writing to the journal *is* the
slow part. I'll probably publish some benchmarks on the mailing list tomorrow,
but, essentially, writing to the journal is the most significant part, followed
by TLS overhead. But if compression is turned on, things are much worse,
because XZ compression was very slow. This patchset was delayed because I
worked on adding LZ4 compression to the journal, which in turned caused other
people to tweak XZ settings, improving compression speed greatly without
significant loss of compression ratio. So in general, things improved on all
fronts. With LZ4 compression, compression overhead should be less significant,
since the speed is in the 500-1500 MB/s range, depending on the compressibility
of data.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20140716/a8982e82/attachment.html>