Performance

Storage Write Speed

Storage throughput is the usual bottleneck. The syslog storage writes messages to disk in sequence, so the disk has to keep up with the incoming rate.

If messages arrive faster than storage can write them, the memory buffer fills and messages are eventually dropped.

  • Keep syslog storage on a local SSD, not a network share or spinning disk.

  • Avoid the same volume as the operating system and program files.

  • Watch the Buffered counter in Monitoring. A value that stays above zero points to a storage bottleneck.

Buffer Size

A larger buffer absorbs longer bursts before dropping messages, and uses more RAM.

  • If the Dropped counter rises during bursts, increase the buffer size.

  • Size the buffer for about 5–10 seconds of peak traffic. At 5,000 messages/sec, 50,000 messages is about 10 seconds.

See Memory Buffer.

Incoming Filter

Discarding unwanted messages before storage is the cheapest way to cut load. If much of the traffic is unused (for example debug from verbose devices), an Incoming Filter removes that work entirely.

Example: If 40% of incoming messages are Debug and they are not needed, a severity filter cuts storage writes by about 40% and extends how long storage lasts.

Character Encoding Conversion

Converting non-UTF-8 messages adds a small cost per message. Leave UTF-8 when originators already send UTF-8 (usual for current devices) so no conversion runs.

See Preprocessor.

Number of Network Interfaces

Each extra UDP, TCP, or TLS listener adds a little overhead. That cost stays small unless dozens of listeners run at once.

TLS Overhead

TLS uses CPU for encryption on each message. On current hardware a few hundred concurrent TLS connections is usually fine; very high connection counts can start to matter.

High-Volume Settings

Apply these in order of effect:

  1. Local SSD storage — the usual bottleneck.

  2. Incoming Filter — drop Debug/Info noise from verbose devices.

  3. Larger buffer — absorb spikes without dropping messages.

  4. UDP for high-volume originators — less per-message cost than TCP or TLS.

  5. More than one Syslog Watcher server — if one installation cannot keep up, send different originators to different servers.

Related Topics