syslog-ng & alertd CPU usage

I share hoolio's sentiment about only logging when you need it, and reducing what you log. For example, based on the calculation you're doing I'll bet you're wanting to track server responses that take too long. I'd consider changing the logic such that you *only* log requests that are past a certain threshold. i.e. if it takes longer than 5000ms, log it, otherwise do nothing.

 

 

Logging at a high rate of speed requires either that you have fast disks, or that we be able to send log messages to a remote host that does. Since BIG-IP doesn't have fast disks, I suggest:

 

a) Reduce how often you're logging

 

b) Reduce how much you're logging

 

c) Send the log messages elsewhere, directly with the log command

 

 

Note the remote host syntax mentioned here:

 

http://devcentral.f5.com/wiki/default.aspx/iRules/log.html

 

 

This allows you to avoid syslog-ng on BIG-IP, and avoid the bottlenecks associated with it.

 

 

Mike Lowell