Can syslog Performance Be Improved?

Question

We have an application on Linux that used the syslog mechanism. After a week spent trying to figure out why this application was running slower than expected, we discovered tha

Answer 1

One trick you can use if you control the source to the logging application is to mask out the log level you want in the app itself, instead of in syslog.conf. I did this years ago with an app that generated a huge, huge, huge amount of debug logs. Rather than remove the calls from the production code, we just masked so that debug level calls never got sent to the daemon. I actually found the code, it's Perl but it's just a front to the setlogmask(3) call.

use Sys::Syslog;
# Start system logging
# setlogmask controls what levels we're going to let get through.  If we mask
# them off here, then the syslog daemon doesn't need to be concerned by them
# 1   = emerg
# 2   = alert
# 4   = crit
# 8   = err
# 16  = warning
# 32  = notice
# 64  = info
# 128 = debug
Sys::Syslog::setlogsock('unix');
openlog($myname,'pid,cons,nowait','mail');
setlogmask(127); # allow everything but debug
#setlogmask(255); # everything
syslog('debug',"syslog opened");

Not sure why I used decimal instead of a bitmask... shrug