[logs] naming multiple output files with syslog-ng

[Bill Burge]

Ummmm....  pulled pork...   uuuuuhhhhhh....  (I miss good pulled  
pork...)

OK, back to topic.

Logging slows things down?  so what?

Even if there is some overhead, I fail to see how it can be bypassed  
as a requirement.  IT will want numbers, sys admins will want debug,  
QA will want 404's, Marketing!  (don't get me started on Marketing! ;-)

I designed and managed a large Com site with multiple apache virtuals  
running on multiple Sun Netra T1's, generating millions of log entries  
a day - syslog remoted out to a 1U OpenBSD box.  We found TONS of  
things to slow down a website; bad database calls, crappy application  
server code, etc - but never blame slow response time on some pretty  
extensive apache logging (referrer entries, all cookies, etc).  (No  
Marcus, I don't have numbers. :-P But if you left heavy logging on and  
fixed the site code, it was plenty fast.  ;-)

If the overhead is too steep, whatever it is - then the environment is  
mis-architected.

If the bun makes the pulled pork sandwich too high to eat, leaving off  
the bun doesn't make it a more functional sandwich.  It makes it an  
entree...

Bill Burge
bill at burge.com



On Dec 20, 2007, at 8:25 AM, Marcus J. Ranum wrote:

>
> Jan Monsch wrote:
>> I personally do not like the solution, because the
>> logger gets invoked by the Apache process and this most likely  
>> produces
>> overhead in the Apache process.
>
> #ifdef  LONG_FORM
>
> The first law of performance tuning is "first you measure, then you
> speculate."
>
> It's quite possible (and if you wanted to lay a bet...) that Apache
> spends an infinitesimal amount of time and resources doing its
> logging. It's also quite possible (consider the sequence of events!)
> that Apache doesn't issue the log message until after the transaction
> with the user is completed, in which case the impact on the user
> is nonexistent. But the point is that nobody knows until somebody
> measures.
>
> Administrators consistently blow logging off because "it'll slow  
> things
> down." To which the correct response is always, "Really? When you
> measured it, how significant was the impact?"
>
> Back when I was programming full time, I used to regularly pick up  
> free
> lunches by betting people their guesses about performance bottlenecks
> were wrong. :)  I was a decent programmer, once, and pretty much
> every time _I_ tried to guess about the bottlenecks in my own code,
> I was wrong.
>
> #endif
>
> #ifdef  WISEASS_FORM
>
> WTF is someone doing even TALKING about performance if they
> are running Apache?
>
> That's like asking "is this stuff fattening?" around a mouthful of
> pulled pork, Ben&Jerry's, and butter.
>
> #endif
>
>
> mjr.
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis at loganalysis.org
> http://www.loganalysis.org/mailman/listinfo/loganalysis