1 |
On Monday 23 March 2009 21:27:15 Steve wrote: |
2 |
> Steve wrote: |
3 |
> >> destination sshguardproc { |
4 |
> >> program("/usr/local/sbin/sshguard" |
5 |
> >> template("$DATE $FULLHOST $MESSAGE\n")); |
6 |
> >> }; |
7 |
> |
8 |
> The presence of the above line is definitely what triggers the excessive |
9 |
> CPU usage - it is almost as-if syslog-ng is 'busy-waiting' for the |
10 |
> sshguard process. The sshguard process is running - but using zero CPU. |
11 |
> |
12 |
> I have this problem with syslog-ng versions 2.1.3 and 2.1.4 (the one |
13 |
> with ~x86)... |
14 |
> |
15 |
> This is very frustrating... having played around, the syslog-ng tends |
16 |
> towards using 100% CPU when my server is otherwise quiet - if, and only |
17 |
> if, I have the program destination... even if the destination is not used. |
18 |
|
19 |
One word: |
20 |
|
21 |
blocking |
22 |
|
23 |
I find this is usually the cause for higher than normal CPU load as reported |
24 |
by top and other tools. If the load is pegged at exactly 100%, it's almost a |
25 |
sure sign that some process is IO blocking on an idle system, and all the |
26 |
process is doing is checking if IO is available, see it isn't, goes to sleep, |
27 |
wakes up, rinse and repeat. |
28 |
|
29 |
In short: top lies, and load does not mean what most people think it means. |
30 |
The correct definition is "average number of processes that are waiting for |
31 |
cpu time within the measurement period." |
32 |
|
33 |
-- |
34 |
alan dot mckinnon at gmail dot com |