Posted by: Anonymous
on July 17, 2008 03:42 PM
You have to look at the whole system to determine what to do. If you're disk IO bound, then moving the logs can have a big performance increase (assuming they're not on the same disks). Generally speaking, writes are a non-blocking operation but enough of them at one time will start to block. Syslog will sync write to the log files if you've not put a - in front of the path (like -/var/log/maillog which you may see on your distro) and that will cause problems if your db or application is busy doing work on the disk. So what to do? You can log to ram if you have some free, but you might lose some logs. If thats acceptable... Do it! If not, find another option like moving logs to another disk. Or, as I do, send all logs via network. I usually only get disk IO bound on our database servers and logging over network (which is not saturated) is a great solution.
You can't just blanket fix or make things faster. For example, if you're not disk IO bound, you won't see much if any performance gain by moving your logs to memory but you will lose some free memory.