[systemd-devel] journald forwarding to rsyslogd. Huge (350 times) performance degradation. What am I doing wrong???

[Vitaly Repin]

Hello,

Thanks for the answer!

However, it looks like that imjournal module is not an option for me.

rsyslog imjournal module documentation
(https://www.rsyslog.com/doc/v8-stable/configuration/modules/imjournal.html)
clearly recommends to use imuxsock module in my case:

[begin quote]
As such, the performance of a configuration utilizing this module may
be notably slower than when using imuxsock.
The journal provides imuxsock with a copy of all “classical” syslog
messages, however, it does not provide structured data. '
Only if that structured data is needed, imjournal must be used.
Otherwise, imjournal may simply be replaced by imuxsock, and we highly
suggest doing so.
[end quote]

I do not need structural data and I need performance. My system
generates a substantial amount of logs. I want to be able to store
messages with an arrival rate of 10 000 messages per second at least.

> Max rate at which log messages are NOT dropped is 17250 msg/s for logging to /run/systemd/journal/syslog.  And only 47 messages per second for logging to /dev/log.


Den sön 20 sep. 2020 kl 12:26 skrev Reindl Harald <h.reindl at thelounge.net>:
>
>
>
> Am 20.09.20 um 12:07 schrieb Vitaly Repin:
>
> > ForwardToSyslog=yes
>
> this is long obsolete
>
>
> $WorkDirectory /var/lib/rsyslog
>
> module(load="imjournal" StateFile="imjournal.state"
> WorkAroundJournalBug="on" Ratelimit.Interval="600" Ratelimit.Burst="50000")
> _______________________________________________
> systemd-devel mailing list
> systemd-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/systemd-devel



-- 
WBR & WBW, Vitaly