LogAnalysis
[logs] naming multiple output files with syslog-ng Dec 17 2007 02:20PM
Christian Folini (christian folini post ch) (2 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 03:55PM
Jan Monsch (jan monsch csnc ch) (1 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 04:25PM
Marcus J. Ranum (mjr ranum com) (3 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 27 2007 01:14AM
Mordechai T. Abzug (morty frakir org) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Jan 01 2008 01:05PM
Chris Brenton (cbrenton chrisbrenton org)
RE: [logs] naming multiple output files with syslog-ng Dec 20 2007 06:22PM
Paul Melson (pmelson gmail com) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 21 2007 06:55AM
Christian Folini (christian folini post ch) (2 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 21 2007 04:16PM
Chris Wee (chris wee loglogic com) (1 replies)
Re: [logs] naming multiple output files with syslog-ng Dec 24 2007 10:49AM
Christian Folini (christian folini post ch)
RE: [logs] naming multiple output files with syslog-ng Dec 21 2007 10:19AM
Jan Monsch (jan monsch csnc ch) (1 replies)
RE: [logs] naming multiple output files with syslog-ng Dec 23 2007 08:06PM
Marcus J. Ranum (mjr ranum com)
Re: [logs] naming multiple output files with syslog-ng Dec 20 2007 05:23PM
Bill Burge (bill burge com)

Ummmm.... pulled pork... uuuuuhhhhhh.... (I miss good pulled
pork...)

OK, back to topic.

Logging slows things down? so what?

Even if there is some overhead, I fail to see how it can be bypassed
as a requirement. IT will want numbers, sys admins will want debug,
QA will want 404's, Marketing! (don't get me started on Marketing! ;-)

I designed and managed a large Com site with multiple apache virtuals
running on multiple Sun Netra T1's, generating millions of log entries
a day - syslog remoted out to a 1U OpenBSD box. We found TONS of
things to slow down a website; bad database calls, crappy application
server code, etc - but never blame slow response time on some pretty
extensive apache logging (referrer entries, all cookies, etc). (No
Marcus, I don't have numbers. :-P But if you left heavy logging on and
fixed the site code, it was plenty fast. ;-)

If the overhead is too steep, whatever it is - then the environment is
mis-architected.

If the bun makes the pulled pork sandwich too high to eat, leaving off
the bun doesn't make it a more functional sandwich. It makes it an
entree...

Bill Burge
bill (at) burge (dot) com [email concealed]

On Dec 20, 2007, at 8:25 AM, Marcus J. Ranum wrote:

>
> Jan Monsch wrote:
>> I personally do not like the solution, because the
>> logger gets invoked by the Apache process and this most likely
>> produces
>> overhead in the Apache process.
>
> #ifdef LONG_FORM
>
> The first law of performance tuning is "first you measure, then you
> speculate."
>
> It's quite possible (and if you wanted to lay a bet...) that Apache
> spends an infinitesimal amount of time and resources doing its
> logging. It's also quite possible (consider the sequence of events!)
> that Apache doesn't issue the log message until after the transaction
> with the user is completed, in which case the impact on the user
> is nonexistent. But the point is that nobody knows until somebody
> measures.
>
> Administrators consistently blow logging off because "it'll slow
> things
> down." To which the correct response is always, "Really? When you
> measured it, how significant was the impact?"
>
> Back when I was programming full time, I used to regularly pick up
> free
> lunches by betting people their guesses about performance bottlenecks
> were wrong. :) I was a decent programmer, once, and pretty much
> every time _I_ tried to guess about the bottlenecks in my own code,
> I was wrong.
>
> #endif
>
> #ifdef WISEASS_FORM
>
> WTF is someone doing even TALKING about performance if they
> are running Apache?
>
> That's like asking "is this stuff fattening?" around a mouthful of
> pulled pork, Ben&Jerry's, and butter.
>
> #endif
>
>
> mjr.
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis (at) loganalysis (dot) org [email concealed]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]
Re: [logs] naming multiple output files with syslog-ng Dec 18 2007 06:22AM
Tom Le (dottom gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus