Re: [fw-wiz] syslog and network management



On Thu, Feb 21, 2008 at 7:19 PM, <david@xxxxxxx> wrote:

if you end up doing much searching through your logs you can end up eating
a LOT more CPU then you imagine, especially as you correlate things and
end up searching for more related items at a time.

I've found that if you utilize, for instance, syslog-ng, you can split
up the log files based on whatever (device type, network, etc.).
Searching those smaller files is a lot less CPU intensive.

Further, if you're using an application such as sec.pl (I think its
called) then you can have everything that comes in copied to a pipe
that sec reads. This can get hair though, YMMV. I've done it on a very
busy syslog server running AIX with no problems.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: [fw-wiz] syslog and network management
    ... I've found that if you utilize, for instance, syslog-ng, you can split ... up the log files based on whatever. ... Searching those smaller files is a lot less CPU intensive. ...
    (Firewall-Wizards)
  • [PATCH 1/2] Customize sched domain via cpuset (v2)
    ... This patch introduces new feature of cpuset - sched domain customization. ... enable us to change the searching range of scheduler, ... +When a task is woken up, scheduler try to move the task on idle CPU. ...
    (Linux-Kernel)
  • Re: CPU Usage: 100%
    ... I have found that interrupts and dpc,s are using up most of the cpu %. ... > Download and run Process Explorer. ... If you meant System Idle Process, ... You could always try searching for it ...
    (microsoft.public.windowsxp.help_and_support)
  • sshd log analyzer
    ... WideFinder 2 log parsing speed project. ... cores and cpus. ... The idea is to split discrete log files up per CPU, or splita large file, ...
    (Focus-Linux)
  • [PATCH] ppc32: Resurrect Documentation/powerpc/cpu_features.txt
    ... Searching through BK logs on linux.bkbits.net didn't reveal anything, ... and if the CPU supports the DOZE and NAP ... +Detection of the feature set is simple. ... unused code is replaced by 'nop' instructions. ...
    (Linux-Kernel)