Can syslog Performance Be Improved?

Question

We have an application on Linux that used the syslog mechanism. After a week spent trying to figure out why this application was running slower than expected, we discovered tha

Answer 1

There are several options to improve syslog performance:

• Optimizing out calls with a macro

   int LogMask = LOG_UPTO(LOG_WARNING);
   #define syslog(a, ...) if ((a) & LogMask ) syslog((a), __VA_ARGS__)
  
   int main(int argc, char **argv)
   {
            LogMask = setlogmask(LOG_UPTO(LOG_WARNING));
            ...
   }
  

  An advantage of using a macro to filter syslog calls is that the entire call is reduced to a conditional jump on a global variable, very helpful if you happen to have DEBUG calls which are translating large datasets through other functions.

• setlogmask()

  setlogmask(LOG_UPTO(LOG_LEVEL))
  

  setlogmask() will optimize the call by not logging to /dev/log, but the program will still call the functions used as arguments.

• filtering with syslog.conf

   *.err                                               /var/log/messages
  

  "check out the man page for syslog.conf for details."

• configure syslog to do asynchronous or buffered logging

  metalog used to buffer log output and flushed it in blocks. stock syslog and syslog-ng do not do this as far as I know.