On Wed, Aug 19, 2009 at 12:47 AM, Subhan Malick<mali...@illinois.edu> wrote: > On 8/17/09 10:15 PM, Fajar A. Nugraha wrote: >> >> Here are some pointers from my experience though: >> - syslog query logging is expensive. NEVER enable it. If you need to >> log client queries, log it directly to file instead. > > I would like to hear more about why this is so. We are currently debating > sending query logs to a remote syslog server to enhance some security tools.
It depends on your requirement. In my case, sending query log to syslog makes disk I/O the bottleneck. Not really sure why logging to file directly fix this issue, perhaps syslog does a sync() for every line or something. > We are running BIND 9.6.1-P1 with multithreading enabled on RHEL 4 (2 > dual-core 2.8 GHz Opterons with 1MB cache, 4G of RAM). I have run some tests > and while there is some queries/sec hit, the RTTs are not terrible. > Queries per second: 2425.385916 qps I got around 6000 qps on a smiliar test. Jinmei mentioned something about getting 24k qps on a 4-way Opteron. Again, it depends on your requirement. If your load is low enough, you might be able to live with performance penalty imposed by syslog. -- Fajar _______________________________________________ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
